Détails IP 102.220.160.26

Synthèse exécutive

Profil de menace

Score de risque —

Première observation 29/06/2026 22:18 UTC

Dernière observation 18/07/2026 04:04 UTC

Événements (période) 83

MITRE ATT&CK principal —

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

ssh_probe

Comparaison ASN / FAI

ASN 197769 · 102.220.160.0/22 · AFRINIC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 83 événements sur la période pour cette IP.

130.12.182.227 Sonde port 18/07/2026 20:24 UTC
102.220.160.67 Sonde port 18/07/2026 16:46 UTC
130.12.182.224 Sonde port 18/07/2026 12:30 UTC
102.220.160.29 Sonde port 18/07/2026 10:07 UTC
130.12.182.107 Sonde port 18/07/2026 05:30 UTC
102.220.160.39 Sonde SSH 18/07/2026 03:53 UTC
130.12.182.110 Sonde SSH 18/07/2026 02:41 UTC
130.12.182.98 Sonde SSH 18/07/2026 02:36 UTC

IPs apparentées

Même FAI VPS Dedicated LLC — corrélation indicative.

130.12.182.227 Sonde port
102.220.160.67 Sonde port
130.12.182.224 Sonde port
102.220.160.29 Sonde port
130.12.182.107 Sonde port

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 66 SSH TCP 2 HTTP ALT 8082 TCP 1

HTTP

SSH

HTTP ALT 8082

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

83 événement(s) — page 1/2

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
18/07/2026 04:04:36 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-libssh_0.11.4 l/@<;׈Lܨ�OU��hcurve25519-sha256… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-libssh_0.11.4 l/@<;׈Lܨ�OU��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sh… Payload SSH-2.0-libssh_0.11.4 l/@<;׈Lܨ�OU��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0391 pat-0392 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) SSH-2.0 banner RFC4253 libssh banner TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-libssh_0.11.4 l/@<;׈Lܨ�OU��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis Requête brute (extrait) SSH-2.0-libssh_0.11.4 l/@<;׈Lܨ�OU��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a", "emulator_response_len": 41, "bytes_in": 1159, "payload_entropy": 4.843000122717508, "port_category": "well_known", "org": "VPS Dedicated LLC", "service": "ssh", "app_proto": "ssh", "asn": 197769, "country": "SI", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0391", "pat-0392", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0391", "pat-0392", "INT-upstream" ], "matched_patterns": [ "pat-0391", "pat-0392", "pat-0536" ], "matched_pattern_names": [ "SSH-2.0 banner RFC4253", "libssh banner", "TFTP RRQ" ], "pattern_ids": [ "pat-0391", "pat-0392", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "87813d1ffc3e6ea7ec0d4cb10febf790", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\/@<;\u05c8L\u0728\ufffdO\u0012\u001fU\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\/@<;\u05c8L\u0728\ufffdO\u0012\u001fU\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie", "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\/@<;\u05c8L\u0728\ufffdO\u0012\u001fU\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "evidence": { "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\/@<;\u05c8L\u0728\ufffdO\u0012\u001fU\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie", "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\/@<;\u05c8L\u0728\ufffdO\u0012\u001fU\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b7438bf36916dbf5d713831d347d42c235ad3f13", "protocol_details": { "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\/@<;\u05c8L\u0728\ufffdO\u0012\u001fU\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\/@<;\u05c8L\u0728\ufffdO\u0012\u001fU\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\/@<;\u05c8L\u0728\ufffdOU\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0391", "pat-0392", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0391", "pat-0392", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\/@<;\u05c8L\u0728\ufffdO\u0012\u001fU\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\/@<;\u05c8L\u0728\ufffdO\u0012\u001fU\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\/@<;\u05c8L\u0728\ufffdOU\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ], "asn_dc_heuristic": true }
16/07/2026 04:15:44 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic dXNlcjox Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 100, "payload_entropy": 4.8835633807812435, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "51a1d4df7668ee2248241db4b65089cbc80918af", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b1a91f0ecfb63882199d985122f7c5e2", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjox\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjox\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjox", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjox\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjox", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4dafb7406ce135317067af3f90d3a483ad99c787", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjox", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjox", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
16/07/2026 04:08:59 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic cm9vdDpQYVNzV29SZHBhc3N3b3JE Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 120, "payload_entropy": 5.236401091923362, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "51a1d4df7668ee2248241db4b65089cbc80918af", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "99aca15bc67ef2cef1609606cac45950", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpQYVNzV29SZHBhc3N3b3JE\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpQYVNzV29SZHBhc3N3b3JE\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpQYVNzV29SZHBhc3N3b3JE", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpQYVNzV29SZHBhc3N3b3JE\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpQYVNzV29SZHBhc3N3b3JE", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5b22be820e24e2f554c7bce9044da653a5eb9723", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpQYVNzV29SZHBhc3N3b3JE", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpQYVNzV29SZHBhc3N3b3JE", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
16/07/2026 03:58:54 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic ODAwMDo4MDAw Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 4.923668868126557, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "51a1d4df7668ee2248241db4b65089cbc80918af", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8ecb97ff2c55ea77bc8c2bdaa06034ec", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6ab5486d102f1ad3e4fa06b5dd9c9a9f58900291", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
16/07/2026 03:53:14 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic dXNlcjox Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 100, "payload_entropy": 4.8835633807812435, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "51a1d4df7668ee2248241db4b65089cbc80918af", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b1a91f0ecfb63882199d985122f7c5e2", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjox\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjox\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjox", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjox\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjox", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4dafb7406ce135317067af3f90d3a483ad99c787", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjox", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjox", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
16/07/2026 03:43:53 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic YTEyMzQ1NjphMTIzNDU2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.02428480652139, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "51a1d4df7668ee2248241db4b65089cbc80918af", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3ad83523a9cb744e748ee177a900b499", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YTEyMzQ1NjphMTIzNDU2\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YTEyMzQ1NjphMTIzNDU2\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YTEyMzQ1NjphMTIzNDU2", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YTEyMzQ1NjphMTIzNDU2\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YTEyMzQ1NjphMTIzNDU2", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "079d175330714892af93765ec369ee17add9ffe0", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YTEyMzQ1NjphMTIzNDU2", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YTEyMzQ1NjphMTIzNDU2", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
16/07/2026 03:38:25 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic dXNlcjp1c2Vy Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 4.935016761699305, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "51a1d4df7668ee2248241db4b65089cbc80918af", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d8cd3626092d50587e4bda8069422cd0", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f1db5618af17753fe023b6d2c3a86b7c5771b997", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
16/07/2026 03:30:47 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic cm9vdDpQYVNzV29SZHBhc3N3b3JE Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 120, "payload_entropy": 5.236401091923362, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "51a1d4df7668ee2248241db4b65089cbc80918af", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "99aca15bc67ef2cef1609606cac45950", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpQYVNzV29SZHBhc3N3b3JE\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpQYVNzV29SZHBhc3N3b3JE\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpQYVNzV29SZHBhc3N3b3JE", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpQYVNzV29SZHBhc3N3b3JE\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpQYVNzV29SZHBhc3N3b3JE", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5b22be820e24e2f554c7bce9044da653a5eb9723", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpQYVNzV29SZHBhc3N3b3JE", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpQYVNzV29SZHBhc3N3b3JE", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
16/07/2026 03:22:35 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic YTEyMzQ1NjphMTIzNDU2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.02428480652139, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "51a1d4df7668ee2248241db4b65089cbc80918af", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3ad83523a9cb744e748ee177a900b499", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YTEyMzQ1NjphMTIzNDU2\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YTEyMzQ1NjphMTIzNDU2\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YTEyMzQ1NjphMTIzNDU2", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YTEyMzQ1NjphMTIzNDU2\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YTEyMzQ1NjphMTIzNDU2", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "079d175330714892af93765ec369ee17add9ffe0", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YTEyMzQ1NjphMTIzNDU2", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YTEyMzQ1NjphMTIzNDU2", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
16/07/2026 03:17:34 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic dXNlcjp1c2Vy Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 102, "payload_entropy": 4.936015905949215, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "51a1d4df7668ee2248241db4b65089cbc80918af", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0fe8b4d50a4286c351c2bfcefa6114c5", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4b7d7073ed11412df9a59aa4627bcc02ac69d267", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
16/07/2026 03:10:25 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic cm9vdDp2YWdyYW50QDEyMw== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 114, "payload_entropy": 5.191234782777794, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "51a1d4df7668ee2248241db4b65089cbc80918af", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9977a1f7d25078c537cdc1ef9baa7126", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDp2YWdyYW50QDEyMw==\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDp2YWdyYW50QDEyMw==\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDp2YWdyYW50QDEyMw==", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDp2YWdyYW50QDEyMw==\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDp2YWdyYW50QDEyMw==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "376f5167885f7335f48c47e5ebc1ffbfa3d76905", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDp2YWdyYW50QDEyMw==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDp2YWdyYW50QDEyMw==", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
16/07/2026 01:10:39 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic YmViZXRvOmJlYmV0bw== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 110, "payload_entropy": 5.146228042043135, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "51a1d4df7668ee2248241db4b65089cbc80918af", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "17c520929b782bd737c6bc934475bf36", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bfe27fc70c8255317bd761b9d730b7fb7be53644", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
16/07/2026 00:48:16 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 4.938876887631449, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "51a1d4df7668ee2248241db4b65089cbc80918af", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ae8d37176cfb5fd3f9db11b758ebdb71", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ed6ce652b063fe1dcf1e8513751dfe2797b94dcd", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
16/07/2026 00:27:29 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 61, "payload_entropy": 3.995407625295488, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "51a1d4df7668ee2248241db4b65089cbc80918af", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2cd3c698a39eff9302513caf5868e130", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c1a44ed8888ae1791fcea3ddfdd87c46aa328d92", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
16/07/2026 00:11:19 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic YXBwcGFzc3BvcnQ6V2VsY29tZUAyMDI2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 124, "payload_entropy": 5.2277202724484955, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "51a1d4df7668ee2248241db4b65089cbc80918af", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c5838dd8f4435691bb9f1d6e7bea0c5f", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YXBwcGFzc3BvcnQ6V2VsY29tZUAyMDI2\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YXBwcGFzc3BvcnQ6V2VsY29tZUAyMDI2\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YXBwcGFzc3BvcnQ6V2VsY29tZUAyMDI2", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YXBwcGFzc3BvcnQ6V2VsY29tZUAyMDI2\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YXBwcGFzc3BvcnQ6V2VsY29tZUAyMDI2", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bef480f5a5c393abaa8233b5284b735d40788515", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YXBwcGFzc3BvcnQ6V2VsY29tZUAyMDI2", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YXBwcGFzc3BvcnQ6V2VsY29tZUAyMDI2", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 23:53:26 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic YWRtaW46cEBzc3dvcmQx Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.0816906952970236, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "51a1d4df7668ee2248241db4b65089cbc80918af", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "baea802686db46854bad8cb2b6b800ab", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46cEBzc3dvcmQx\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46cEBzc3dvcmQx\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46cEBzc3dvcmQx", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46cEBzc3dvcmQx\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46cEBzc3dvcmQx", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ffa51dd350251cc2897e4d0ba6c1061ad82f5bad", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46cEBzc3dvcmQx", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46cEBzc3dvcmQx", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 23:34:07 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic cm9vdDohUTJ3I0U= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.058503596321668, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "3eabfdeed96bd9f732ae12d0334df2b2bf5fc8be", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bec470cb1e94d3774d1c159924d99bda", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDohUTJ3I0U=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDohUTJ3I0U=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDohUTJ3I0U=", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDohUTJ3I0U=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDohUTJ3I0U=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "24e2b24dbf08b9d782ba928db006d73f6049090a", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDohUTJ3I0U=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDohUTJ3I0U=", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 23:25:54 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic cm9vdDpXbTEyMzQ1NkA= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 110, "payload_entropy": 5.153408236643158, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "3eabfdeed96bd9f732ae12d0334df2b2bf5fc8be", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "307192e292cfdb97abfbffaa49805d5c", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpXbTEyMzQ1NkA=\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpXbTEyMzQ1NkA=\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpXbTEyMzQ1NkA=", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpXbTEyMzQ1NkA=\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpXbTEyMzQ1NkA=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f18a83fc6a40cf6734121b2ff857384552f6ae28", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpXbTEyMzQ1NkA=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDpXbTEyMzQ1NkA=", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 23:15:19 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic MTox Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 96, "payload_entropy": 4.767050980981351, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "3eabfdeed96bd9f732ae12d0334df2b2bf5fc8be", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "16ff380c6a226dc44d53771709f08796", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTox\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTox\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTox", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTox\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTox", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3b8debe0c0ff4db711954d239f5a2651d9ada2aa", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTox", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTox", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 23:06:31 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic cm9vdDprdWt1OHZpY2E= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.085487958059544, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "3eabfdeed96bd9f732ae12d0334df2b2bf5fc8be", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "28053c19c710a1c9077801c5aa502cba", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDprdWt1OHZpY2E=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDprdWt1OHZpY2E=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDprdWt1OHZpY2E=", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDprdWt1OHZpY2E=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDprdWt1OHZpY2E=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4a348697ecf7d31eaee6b4f1820fd9f6778159e7", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDprdWt1OHZpY2E=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDprdWt1OHZpY2E=", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:58:12 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 36, "payload_entropy": 3.916607904809985, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "3eabfdeed96bd9f732ae12d0334df2b2bf5fc8be", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "eb1058abdd74de3ff2ea58a3e158d8cc", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d8e623042922d14961a3e17967d4e30f282c401f", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:49:24 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic dXNlcjM6MTIzNA== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.00933652165401, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "3eabfdeed96bd9f732ae12d0334df2b2bf5fc8be", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f7ca32896a247258d0658c56cc876f34", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjM6MTIzNA==\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjM6MTIzNA==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjM6MTIzNA==", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjM6MTIzNA==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjM6MTIzNA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "43b9fefe72e722ffb9bd922d245ebd32bbb48dd9", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjM6MTIzNA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjM6MTIzNA==", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:42:44 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 36, "payload_entropy": 3.916607904809985, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "3eabfdeed96bd9f732ae12d0334df2b2bf5fc8be", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "eb1058abdd74de3ff2ea58a3e158d8cc", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d8e623042922d14961a3e17967d4e30f282c401f", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:35:10 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.039236342599136, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "3eabfdeed96bd9f732ae12d0334df2b2bf5fc8be", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ea63e6dd03035c23202ea257ccb5bd10", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8178b4af8c023766c055de9f11eef7e6830898d7", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
13/07/2026 21:47:24 UTC	TCP	32333	—	proxy probe proxy probe · port 32333 · (sonde / probe)	—	Faible · 24
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 32333 Chemin / cible — Payload � Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 24 Confiance : Confiance 0 % — 1 signal(aux) capteur Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut { "bytes_in": 9, "payload_entropy": 1.4466166676282082, "port_category": "registered", "org": "VPS Dedicated LLC", "service": null, "app_proto": null, "asn": 197769, "country": "SI", "dst_port": 32333, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 0.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0 }, "risk_score": 24, "tag_count": 1, "anomaly_count": 0, "campaign_key": "d2b03a8403c8d40061e7cdf5fa92dbbf86cb8de6", "event_fingerprint": "65eed07e893e550dc3150194e66e0c041f34636c", "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 24 }, "named_classification_skipped": false, "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6266f12abef0bbe34ce5d154de5a6068", "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3" }, "target_context": { "dst_port": 32333, "risk_score": 24 }, "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000", "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000", "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000", "evidence": { "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000", "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000", "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cd9b1fbcd711c5c00d30118f89b53ded8dec83fd", "protocol_details": { "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000", "port": 32333 }, "evidence_snippet": "\ufffd", "attack_vector": "proxy probe \u00b7 port 32333 \u00b7 (sonde \/ probe)", "target_port_label": "32333", "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 24 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 24, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 32333, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000", "port": 32333 }, "attack_vector": "proxy probe \u00b7 port 32333 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd", "target_port_label": "32333", "emulator_service": null, "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "32333" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "socks4_greeting" ], "asn_dc_heuristic": true }
13/07/2026 21:47:24 UTC	TCP	32333 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:32333 · (sonde / probe) · → 1.1.1.1:443	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 1.1.1.1:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 1.1.1.1:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 32333 Chemin / cible 1.1.1.1:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 1.1.1.1:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 1.1.1.1:443 HTTP/1.0 Host: 1.1.1.1 Meta JSON brut { "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "1:443", "http_ua_hash": null, "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f", "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 47, "payload_entropy": 3.912028011761936, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 32333, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "0c59c3adc64859e30ff2e71f3bdf1ff93174ae92", "event_fingerprint": "9dee17fc9d030bed3e6cafd6a65465fd2a89bc3e", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "eca058040bfea8cad9218ced7d8b12d9", "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4" }, "service_name": "http", "target_context": { "dst_port": 32333, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "method": "CONNECT", "path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "evidence": { "method": "CONNECT", "path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d141b4ad9acc5e5bca3fa45620e780f1cee45d9f", "protocol_details": { "http_method": "CONNECT", "http_path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "port": 32333, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "attack_vector": "Sonde HTTP \u00b7 via HTTP:32333 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443", "target_port_label": "32333 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 32333, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "port": 32333, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:32333 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443", "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "target_port_label": "32333 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "32333" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:32333" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
13/07/2026 21:47:23 UTC	TCP	32333	—	Sonde port Sonde port · port 32333 · (sonde / probe)	—	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 32333 Chemin / cible — Payload Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "VPS Dedicated LLC", "service": null, "app_proto": null, "asn": 197769, "country": "SI", "dst_port": 32333, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 0, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "6c609f61be1a9d0a0ba25bd04bd423bd8ae506f7", "event_fingerprint": "4a96a1360ceb3ce68d85118e2494a80a41cd32cc", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 32333, "risk_score": 44 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "00dae9f9b7321ccbdccf961e4199dadad9d0f01d", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 32333 }, "attack_vector": "Sonde port \u00b7 port 32333 \u00b7 (sonde \/ probe)", "target_port_label": "32333", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 32333, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 32333 }, "attack_vector": "Sonde port \u00b7 port 32333 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "32333", "emulator_service": null, "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "32333" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
13/07/2026 21:47:20 UTC	TCP	32333	—	Sonde port Sonde port · port 32333 · (sonde / probe)	—	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 32333 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "VPS Dedicated LLC", "service": null, "app_proto": null, "asn": 197769, "country": "SI", "dst_port": 32333, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 0, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "6c609f61be1a9d0a0ba25bd04bd423bd8ae506f7", "event_fingerprint": "4a96a1360ceb3ce68d85118e2494a80a41cd32cc", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 32333, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "34449eb16793295a1d8a5d8552d6eccccae3154c", "protocol_details": { "port": 32333 }, "attack_vector": "Sonde port \u00b7 port 32333 \u00b7 (sonde \/ probe)", "target_port_label": "32333", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 32333, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 32333 }, "attack_vector": "Sonde port \u00b7 port 32333 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "32333", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "32333" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
13/07/2026 01:20:34 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	—	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-libssh_0.11.4 lx��6��g�x��c�hcurve25519-sha2… Émulateur SSH WAF — Recommandation Investiguer Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-libssh_0.11.4 lx��6��g�x��c�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-… Payload SSH-2.0-libssh_0.11.4 lx��6��g�x��c�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0391 pat-0392 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) SSH-2.0 banner RFC4253 libssh banner TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-libssh_0.11.4 lx��6��g�x��c�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis Requête brute (extrait) SSH-2.0-libssh_0.11.4 lx��6��g�x��c�hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a", "emulator_response_len": 40, "bytes_in": 1159, "payload_entropy": 4.821763833210031, "port_category": "well_known", "org": "VPS Dedicated LLC", "service": "ssh", "app_proto": "ssh", "asn": 197769, "country": "SI", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0391", "pat-0392", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0391", "pat-0392", "INT-upstream" ], "matched_patterns": [ "pat-0391", "pat-0392", "pat-0536" ], "matched_pattern_names": [ "SSH-2.0 banner RFC4253", "libssh banner", "TFTP RRQ" ], "pattern_ids": [ "pat-0391", "pat-0392", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "dfe78a8dac3a4bb748692811eaabbdb9", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014x\ufffd\ufffd6\ufffd\ufffdg\ufffdx\ufffd\ufffd\ufffd\u0014\ufffdc\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014x\ufffd\ufffd6\ufffd\ufffdg\ufffdx\ufffd\ufffd\ufffd\u0014\ufffdc\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie", "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014x\ufffd\ufffd6\ufffd\ufffdg\ufffdx\ufffd\ufffd\ufffd\u0014\ufffdc\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "evidence": { "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014x\ufffd\ufffd6\ufffd\ufffdg\ufffdx\ufffd\ufffd\ufffd\u0014\ufffdc\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie", "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014x\ufffd\ufffd6\ufffd\ufffdg\ufffdx\ufffd\ufffd\ufffd\u0014\ufffdc\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8b4ceff90584d265c76c1bdd6f8c77204fe97b77", "protocol_details": { "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014x\ufffd\ufffd6\ufffd\ufffdg\ufffdx\ufffd\ufffd\ufffd\u0014\ufffdc\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014x\ufffd\ufffd6\ufffd\ufffdg\ufffdx\ufffd\ufffd\ufffd\u0014\ufffdc\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nlx\ufffd\ufffd6\ufffd\ufffdg\ufffdx\ufffd\ufffd\ufffd\ufffdc\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0391", "pat-0392", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0391", "pat-0392", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014x\ufffd\ufffd6\ufffd\ufffdg\ufffdx\ufffd\ufffd\ufffd\u0014\ufffdc\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014x\ufffd\ufffd6\ufffd\ufffdg\ufffdx\ufffd\ufffd\ufffd\u0014\ufffdc\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nlx\ufffd\ufffd6\ufffd\ufffdg\ufffdx\ufffd\ufffd\ufffd\ufffdc\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ], "asn_dc_heuristic": true }
12/07/2026 11:38:47 UTC	TCP	18419 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:18419 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 18419 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic cm9vdDoxOTk5MTIyMw== Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.127630400901726, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 18419, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "796981cbf49dc4c266b829299ded31cb26df0323", "event_fingerprint": "a51d8f4af1ddf72ddc1478094f72d04a35bdb1c4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8b25f24d52ef1db4edd41201b01ed8a0", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 18419, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDoxOTk5MTIyMw==\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDoxOTk5MTIyMw==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDoxOTk5MTIyMw==", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDoxOTk5MTIyMw==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDoxOTk5MTIyMw==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "03946ebf7972feb6ed9c8d68612d1c31e195076f", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 18419, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDoxOTk5MTIyMw==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:18419 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "18419 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 18419, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 18419, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:18419 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic cm9vdDoxOTk5MTIyMw==", "target_port_label": "18419 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "18419" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
12/07/2026 11:31:29 UTC	TCP	18419 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:18419 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 18419 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic MTExOjExMQ== Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 102, "payload_entropy": 4.928019308351512, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 18419, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "796981cbf49dc4c266b829299ded31cb26df0323", "event_fingerprint": "a51d8f4af1ddf72ddc1478094f72d04a35bdb1c4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e240e452c624c35ee5bde0c7e94a3c53", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 18419, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTExOjExMQ==\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTExOjExMQ==\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTExOjExMQ==", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTExOjExMQ==\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTExOjExMQ==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "754be2df8a7a0b5141a42887f2362c6c905e2b15", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 18419, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTExOjExMQ==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:18419 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "18419 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 18419, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 18419, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:18419 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTExOjExMQ==", "target_port_label": "18419 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "18419" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
12/07/2026 11:25:28 UTC	TCP	18419 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:18419 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 18419 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic MTIzNDU6MTIzNDU= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 4.95040570705586, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 18419, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "796981cbf49dc4c266b829299ded31cb26df0323", "event_fingerprint": "a51d8f4af1ddf72ddc1478094f72d04a35bdb1c4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b6c8047a7fea2d5f3e0d8e2652d10f9c", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 18419, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6c90be5194306bf32ce658d7827ea17cc92bb4b0", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 18419, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:18419 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "18419 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 18419, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 18419, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:18419 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "target_port_label": "18419 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "18419" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
12/07/2026 11:17:54 UTC	TCP	18419 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:18419 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 18419 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic dXNlcjpvcmFjbGU= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.132901132468327, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 18419, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "796981cbf49dc4c266b829299ded31cb26df0323", "event_fingerprint": "a51d8f4af1ddf72ddc1478094f72d04a35bdb1c4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "70423743727ea40b3491c715cb37cbcd", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 18419, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjpvcmFjbGU=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjpvcmFjbGU=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjpvcmFjbGU=", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjpvcmFjbGU=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjpvcmFjbGU=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ab261a1fdb507f2097908fca984044abce1a167b", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 18419, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjpvcmFjbGU=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:18419 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "18419 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 18419, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 18419, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:18419 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjpvcmFjbGU=", "target_port_label": "18419 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "18419" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
12/07/2026 00:58:33 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 63, "payload_entropy": 4.015932503616769, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "61acea9027fe2472d4264e4112e69b302eb74648", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1679ebd95df27d43c370bd3d57a1bc0d", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c87df2b57dadee588729cfed8830552a1e22b912", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
12/07/2026 00:52:26 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic dXNlcjE6cGFzczE= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 4.999896243796104, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "61acea9027fe2472d4264e4112e69b302eb74648", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d593d7233b6a32044391557de29dc3c3", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "96cffc466164c51b5952c4ab1f5c832bf49e6010", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8082" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
12/07/2026 00:47:55 UTC	TCP	8082 · HTTP ALT 8082	http-alt-8082	http-alt-8082 http-alt-8082 · via HTTP ALT 8082:8082 · (sonde / probe)	—	Faible · 2
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur HTTP-ALT-8082 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8082 Chemin / cible — Service HTTP ALT 8082 Pourquoi cette classification : Type « http-alt-8082 » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 2 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http-alt-8082", "app_proto": "http-alt-8082", "asn": 197769, "country": "SI", "dst_port": 8082, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 40, "protocol": 22, "novelty": 0 }, "risk_score": 2, "tag_count": 0, "anomaly_count": 0, "campaign_key": "fe1eeea9db4fe10f9c4d29199d71cd915285d71d", "event_fingerprint": "0e49cbf0cd38e11c005312d70c60a0ee389bb82f", "classification_reason": "Type \u00ab http-alt-8082 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 40, "protocol": 22, "novelty": 0, "risk_score": 2 }, "named_classification_skipped": false, "service_name": "http-alt-8082", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "ab911db9a03f822d13fe3595fc5be734" }, "target_context": { "dst_port": 8082, "service": "http-alt-8082", "service_name": "http-alt-8082", "risk_score": 2 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e68a7ea02e189f60ac6563825c3c7f853eb86b82", "protocol_details": { "port": 8082, "service": "http-alt-8082", "service_label_fr": "HTTP ALT 8082" }, "attack_vector": "http-alt-8082 \u00b7 via HTTP ALT 8082:8082 \u00b7 (sonde \/ probe)", "target_port_label": "8082 \u00b7 HTTP ALT 8082", "emulator_service": "http-alt-8082", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab http-alt-8082 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab http-alt-8082 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 40, "protocol": 22, "novelty": 0, "risk_score": 2 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 2, "risk_label": "Faible", "service_name": "http-alt-8082", "service_label_fr": "HTTP ALT 8082", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http-alt-8082", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 8082, "service": "http-alt-8082", "service_label_fr": "HTTP ALT 8082" }, "attack_vector": "http-alt-8082 \u00b7 via HTTP ALT 8082:8082 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "8082 \u00b7 HTTP ALT 8082", "emulator_service": "http-alt-8082", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http_alt_8082", "service_banner": "honeypot-http-alt-8082", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
12/07/2026 00:41:17 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic YWRtaW5pc3RyYXRvcjphZG1pbmlzdHJhdG9y Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 126, "payload_entropy": 5.345502245167015, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "61acea9027fe2472d4264e4112e69b302eb74648", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "531e4a2620951e616e6e28d84f68a07d", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW5pc3RyYXRvcjphZG1pbmlzdHJhdG9y\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW5pc3RyYXRvcjphZG1pbmlzdHJhdG9y\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW5pc3RyYXRvcjphZG1pbmlzdHJhdG9y", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW5pc3RyYXRvcjphZG1pbmlzdHJhdG9y\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW5pc3RyYXRvcjphZG1pbmlzdHJhdG9y", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "021f66aa6029912f7735e981be3fb6a7afb91b6a", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW5pc3RyYXRvcjphZG1pbmlzdHJhdG9y", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW5pc3RyYXRvcjphZG1pbmlzdHJhdG9y", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
12/07/2026 00:35:56 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 36, "payload_entropy": 3.916607904809985, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "61acea9027fe2472d4264e4112e69b302eb74648", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "eb1058abdd74de3ff2ea58a3e158d8cc", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "77e3716b19964a8147574e6ab2152bd7699b3d97", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
12/07/2026 00:31:14 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic ZGViaWFuOmRlYmlhbg== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.167491056675924, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "61acea9027fe2472d4264e4112e69b302eb74648", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "44a3353abe99fab5d24da2ba172631a7", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic ZGViaWFuOmRlYmlhbg==\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic ZGViaWFuOmRlYmlhbg==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic ZGViaWFuOmRlYmlhbg==", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic ZGViaWFuOmRlYmlhbg==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic ZGViaWFuOmRlYmlhbg==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "61fc2f9d105458671221122e410c63be562ec6a6", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic ZGViaWFuOmRlYmlhbg==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic ZGViaWFuOmRlYmlhbg==", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
12/07/2026 00:26:44 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic c3VwcG9ydDpzdXBwb3J0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.136733525978992, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "61acea9027fe2472d4264e4112e69b302eb74648", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "05619e0d4a867d4f362ef78c2b265a03", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic c3VwcG9ydDpzdXBwb3J0\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic c3VwcG9ydDpzdXBwb3J0\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic c3VwcG9ydDpzdXBwb3J0", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic c3VwcG9ydDpzdXBwb3J0\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic c3VwcG9ydDpzdXBwb3J0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b4c424f00eae0cb37f876fe83bb3614ea409100d", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic c3VwcG9ydDpzdXBwb3J0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic c3VwcG9ydDpzdXBwb3J0", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
11/07/2026 23:38:47 UTC	TCP	8082 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8082 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8082 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic MTExMjIyOjExMTIyMg== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 4.9967819899012484, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8082, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "de4b792978daffc657a96afe3825931666ed7cf4", "event_fingerprint": "61acea9027fe2472d4264e4112e69b302eb74648", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8cff566693bc5f31d087656c8288822d", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 8082, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTExMjIyOjExMTIyMg==\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTExMjIyOjExMTIyMg==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTExMjIyOjExMTIyMg==", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTExMjIyOjExMTIyMg==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTExMjIyOjExMTIyMg==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8d97d296465373d216487853831ceb9b1e4a88cb", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTExMjIyOjExMTIyMg==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8082, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 8082, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTExMjIyOjExMTIyMg==", "target_port_label": "8082 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8082" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
11/07/2026 22:06:52 UTC	TCP	5685 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:5685 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 5685 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic YWRtaW46QWRtaW5AMTIzNDU= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 116, "payload_entropy": 5.115488354011549, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 5685, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "9bb0cbc237f6a7e3c5cb334599125809c70b1f2d", "event_fingerprint": "ea1a17cb5cc41195be23d56fd5400bcd0a9c5c33", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "66e17935c9a0a1035903b3dcabdd397d", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 5685, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW5AMTIzNDU=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW5AMTIzNDU=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW5AMTIzNDU=", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW5AMTIzNDU=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW5AMTIzNDU=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f8f7e5af255c26007123712dacf4636a46815a98", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 5685, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW5AMTIzNDU=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:5685 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "5685 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 5685, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 5685, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:5685 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW5AMTIzNDU=", "target_port_label": "5685 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "5685" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
11/07/2026 10:33:29 UTC	TCP	22689 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:22689 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 22689 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic amFjazpqYWNr Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 4.977607718842296, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 22689, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "74ccebfbd9a6ec7e6135ed11925ce563ad5a5c56", "event_fingerprint": "a129411ddc859d083ad3e49f52811f3fb8edc786", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "098dfc09815d68a3f1ac13751432407a", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 22689, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic amFjazpqYWNr\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic amFjazpqYWNr\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic amFjazpqYWNr", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic amFjazpqYWNr\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic amFjazpqYWNr", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e737e3389af6b3ad6ecfaef5ab36d92ef35c236e", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 22689, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic amFjazpqYWNr", "attack_vector": "Sonde HTTP \u00b7 via HTTP:22689 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "22689 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 22689, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 22689, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:22689 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic amFjazpqYWNr", "target_port_label": "22689 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "22689" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
11/07/2026 10:25:38 UTC	TCP	22689 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:22689 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 22689 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic YWRtaW46MTIzNDU2Nw== Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.065847503236153, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 22689, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "74ccebfbd9a6ec7e6135ed11925ce563ad5a5c56", "event_fingerprint": "a129411ddc859d083ad3e49f52811f3fb8edc786", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "07b00bb686cb8d4d97adf77b449aa923", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 22689, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2Nw==\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2Nw==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2Nw==", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2Nw==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2Nw==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9b0419937811443ea7f2c295c85a1578f865b256", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 22689, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2Nw==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:22689 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "22689 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 22689, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 22689, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:22689 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2Nw==", "target_port_label": "22689 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "22689" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
11/07/2026 10:19:46 UTC	TCP	22689	—	Sonde port Sonde port · port 22689 · (sonde / probe)	—	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22689 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "VPS Dedicated LLC", "service": null, "app_proto": null, "asn": 197769, "country": "SI", "dst_port": 22689, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "dfc76a0f12e1f2da277f743cf253106fc35af830", "event_fingerprint": "da3acdd800b657f55ee3ceca7bdff612f599d96c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 22689, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3114d3e388cdb63c2b40fac98e1b68c743dc1c04", "protocol_details": { "port": 22689 }, "attack_vector": "Sonde port \u00b7 port 22689 \u00b7 (sonde \/ probe)", "target_port_label": "22689", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 22689, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 22689 }, "attack_vector": "Sonde port \u00b7 port 22689 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "22689", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "22689" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
11/07/2026 10:11:09 UTC	TCP	22689 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:22689 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 22689 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Meta JSON brut { "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 36, "payload_entropy": 3.916607904809985, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 22689, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "74ccebfbd9a6ec7e6135ed11925ce563ad5a5c56", "event_fingerprint": "a129411ddc859d083ad3e49f52811f3fb8edc786", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "eb1058abdd74de3ff2ea58a3e158d8cc", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 22689, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "df20211d0783da7688f1a468c6ceea9df714b945", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 22689, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:22689 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "22689 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 22689, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 22689, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:22689 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "target_port_label": "22689 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "22689" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
11/07/2026 07:58:17 UTC	TCP	32935 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:32935 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 32935 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic MTox Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 96, "payload_entropy": 4.767050980981351, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 32935, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "33a306bca50d121e8f488605af596e4abada3d35", "event_fingerprint": "7e0f084c36f78418b5f8de31b410d18da2e8929e", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "16ff380c6a226dc44d53771709f08796", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 32935, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTox\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTox\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTox", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTox\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTox", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8e0d78b1f24dce8e6c3213be72ce81d90259e099", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 32935, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTox", "attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "32935 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 32935, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 32935, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic MTox", "target_port_label": "32935 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "32935" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
11/07/2026 07:52:19 UTC	TCP	32935 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:32935 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 32935 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Meta JSON brut { "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 36, "payload_entropy": 3.916607904809985, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 32935, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "33a306bca50d121e8f488605af596e4abada3d35", "event_fingerprint": "7e0f084c36f78418b5f8de31b410d18da2e8929e", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "eb1058abdd74de3ff2ea58a3e158d8cc", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 32935, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4af22f0ca4eca15d4bb4b1f6a3095f291ad39c7b", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 32935, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "32935 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 32935, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 32935, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0", "target_port_label": "32935 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "32935" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
11/07/2026 07:46:59 UTC	TCP	32935 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:32935 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 32935 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic dXNlcjpQNHNzdzByZA== Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.06821056132982, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 32935, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "33a306bca50d121e8f488605af596e4abada3d35", "event_fingerprint": "7e0f084c36f78418b5f8de31b410d18da2e8929e", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "33ba2d8df359371ba7fd13f17214bd50", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 32935, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjpQNHNzdzByZA==\r\n\r\n", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjpQNHNzdzByZA==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjpQNHNzdzByZA==", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjpQNHNzdzByZA==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjpQNHNzdzByZA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cc3dc3db7abfbef11eaf978fdf141e453a914246", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 32935, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjpQNHNzdzByZA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "32935 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 32935, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 32935, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic dXNlcjpQNHNzdzByZA==", "target_port_label": "32935 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "32935" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
11/07/2026 07:41:16 UTC	TCP	32935 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:32935 · (sonde / probe) · → 102.220.160.26:80	—	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.26:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags — Cible HTTP CONNECT 102.220.160.26:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 32935 Chemin / cible 102.220.160.26:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.26:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.26:80 HTTP/1.0 Host: 102.220.160.26:80 Proxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "26:80", "http_ua_hash": null, "http_host_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_target_hash": "50d915d5056d3d63d35488b9445a3c7ff757c66b", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 132, "payload_entropy": 5.321894231614805, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 32935, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "33a306bca50d121e8f488605af596e4abada3d35", "event_fingerprint": "7e0f084c36f78418b5f8de31b410d18da2e8929e", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f9ba2c02886c0bf0967c936cd1d1c487", "path_pattern_hash": "b0ecca8c3423aa11ba20ce96dbf1ad09" }, "service_name": "http", "target_context": { "dst_port": 32935, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "evidence": { "method": "CONNECT", "path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e39cb2b8afa2c07f42a65ce6cd1dc6db0fb7d766", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 32935, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "target_port_label": "32935 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 32935, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.26:80", "request_line": "CONNECT 102.220.160.26:80 HTTP\/1.1", "port": 32935, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:32935 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.26:80", "evidence_snippet": "CONNECT 102.220.160.26:80 HTTP\/1.0\r\nHost: 102.220.160.26:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "target_port_label": "32935 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "32935" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }

102.220.160.26

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence