Renseignement sur les menaces

Slovénie

102.220.160.38

FAI VPS Dedicated LLC Première vue 29/06/2026 07:00 UTC Dernière vue 26/07/2026 00:34 UTC Risque Moyen

Période analysée : 2026-06-27 → 2026-07-27

Activité suspecte — risque 46/100 (Moyen) — MITRE TA0001 — confiance 49 % — via HDFS NAMENODE

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 46/100 Moyen

Première observation 29/06/2026 07:00 UTC

Dernière observation 26/07/2026 00:34 UTC

Événements (période) 287

MITRE ATT&CK principal TA0007 244 occurrences

Activité suspecte — risque 46/100 (Moyen) — MITRE TA0001 — confiance 49 % — via HDFS NAMENODE

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « http_flood » (signaux protocolaires) · confiance 49%

Confiance 49 % — Score WAF 8

Comparaison ASN / FAI

ASN 197769 · 102.220.160.0/22 · AFRINIC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 287 événements sur la période pour cette IP.

102.220.160.47 Flood / DDoS 26/07/2026 23:03 UTC
130.12.182.223 Flood / DDoS 26/07/2026 22:21 UTC
130.12.182.230 Flood / DDoS 26/07/2026 19:46 UTC
130.12.182.98 Flood / DDoS 26/07/2026 15:22 UTC
130.12.182.227 Flood / DDoS 26/07/2026 12:13 UTC
102.220.160.42 Flood / DDoS 26/07/2026 11:29 UTC
102.220.160.26 Flood / DDoS 26/07/2026 09:10 UTC
102.220.160.29 Flood / DDoS 26/07/2026 08:34 UTC

Événements (filtres)

287

Première observation

29/06/2026 07:00 UTC

Dernière observation

26/07/2026 00:34 UTC

Dernière activité (filtres)

26/07/2026 00:34 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 179 HDFS NAMENODE TCP 31 SOCKS5 TCP 23 HTTPS TCP 12 SQUID TCP 7 CONSUL WAN TCP 7

HTTP

179

HDFS NAMENODE

SOCKS5

HTTPS

SQUID

CONSUL WAN

Géolocalisation

Origine réseau déclarée

Slovénie unknown unknown

FAI / réseau

Opérateur et dernière activité ban

VPS Dedicated LLC 0 Port 8020 http_flood

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Chaîne d'attaque

Exploitation

Vecteur d'attaque

http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)

Détails protocole

Aperçu payload

CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cjpy

Port / service

8020 · HDFS NAMENODE

Service émulé

HDFS-NAMENODE

Raison confiance

Confiance 49 % — Motif catalogue confirmé

Technique MITRE

TA0001

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0418

Confiance

49% Confiance modérée — signal unique

Famille de menace

ddos

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

287 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

287 événement(s) — page 1/6

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
26/07/2026 00:34:56 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cjpy Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cjpy Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 96, "payload_entropy": 4.885227834814126, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "41292a1680259bbf99af2c821203869f", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cjpy\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cjpy\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cjpy", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cjpy\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cjpy", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5ef80ea6f7849aacfa6051c2ff0b1221839427a1", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cjpy", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cjpy", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cjpy", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cjpy", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
26/07/2026 00:34:52 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic ODg4ODo4ODg4 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic ODg4ODo4ODg4 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 104, "payload_entropy": 4.947613339238797, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "02ac3308802328db9f54c9d4dd4c18a9", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7799a9667202d0d8e252d8b457e2e2a8044014bd", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
26/07/2026 00:34:44 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 36, "payload_entropy": 4.006749918638778, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d3b1103b4c2d66de5ec9ef428e03ecd0", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "008fdc98847d653e931fc80f2eea3b249782dc19", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
26/07/2026 00:34:33 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDo6bWNzbi1hZnJpY2EuY29t Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDo6bWNzbi1hZnJpY2EuY29t Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 120, "payload_entropy": 5.197102862882897, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "749294233a09c76383603d904a4b0dd1", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo6bWNzbi1hZnJpY2EuY29t\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo6bWNzbi1hZnJpY2EuY29t\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo6bWNzbi1hZnJpY2EuY29t", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo6bWNzbi1hZnJpY2EuY29t\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo6bWNzbi1hZnJpY2EuY29t", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c4faf119bab125030ceacdb2c07965206ba9f042", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo6bWNzbi1hZnJpY2EuY29t", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo6bWNzbi1hZnJpY2EuY29t", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo6bWNzbi1hZnJpY2EuY29t", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo6bWNzbi1hZnJpY2EuY29t", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
26/07/2026 00:34:32 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 36, "payload_entropy": 4.006749918638778, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d3b1103b4c2d66de5ec9ef428e03ecd0", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "008fdc98847d653e931fc80f2eea3b249782dc19", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
26/07/2026 00:34:26 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic NTkyMjpUaWtpMjAyNUAh Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic NTkyMjpUaWtpMjAyNUAh Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 112, "payload_entropy": 5.075842284296545, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6d8a942eed1713b4a831615e7d3a10b8", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic NTkyMjpUaWtpMjAyNUAh\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic NTkyMjpUaWtpMjAyNUAh\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic NTkyMjpUaWtpMjAyNUAh", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic NTkyMjpUaWtpMjAyNUAh\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic NTkyMjpUaWtpMjAyNUAh", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f758ec4ec4b6496804be0da7080317fe528396c8", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic NTkyMjpUaWtpMjAyNUAh", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic NTkyMjpUaWtpMjAyNUAh", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic NTkyMjpUaWtpMjAyNUAh", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic NTkyMjpUaWtpMjAyNUAh", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
26/07/2026 00:25:21 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDowNTA4MTk3OQ== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDowNTA4MTk3OQ== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 112, "payload_entropy": 5.172098704395887, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5c6cdd2c69558e7fc377d4b3a530c69c", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDowNTA4MTk3OQ==\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDowNTA4MTk3OQ==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDowNTA4MTk3OQ==", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDowNTA4MTk3OQ==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDowNTA4MTk3OQ==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ff373654c644c378e91e01f5a9c72c1991f4bed3", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDowNTA4MTk3OQ==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDowNTA4MTk3OQ==", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDowNTA4MTk3OQ==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDowNTA4MTk3OQ==", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
26/07/2026 00:24:51 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 36, "payload_entropy": 4.006749918638778, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d3b1103b4c2d66de5ec9ef428e03ecd0", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "008fdc98847d653e931fc80f2eea3b249782dc19", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
26/07/2026 00:24:40 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDptb25leTMyMQ== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDptb25leTMyMQ== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 112, "payload_entropy": 5.219797222300242, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0d12cc74dbbb5def7f1fa1500fad4b76", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDptb25leTMyMQ==\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDptb25leTMyMQ==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDptb25leTMyMQ==", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDptb25leTMyMQ==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDptb25leTMyMQ==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "25efa6fe28f27ea68646b2dfecff0d5803372bce", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDptb25leTMyMQ==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDptb25leTMyMQ==", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDptb25leTMyMQ==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDptb25leTMyMQ==", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
26/07/2026 00:24:36 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic eW91a2hhbm5hOnlvdWtoYW5uYQ== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic eW91a2hhbm5hOnlvdWtoYW5uYQ== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 120, "payload_entropy": 5.227049763244842, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c1b5f273764aab93f8b4490805466395", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic eW91a2hhbm5hOnlvdWtoYW5uYQ==\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic eW91a2hhbm5hOnlvdWtoYW5uYQ==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic eW91a2hhbm5hOnlvdWtoYW5uYQ==", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic eW91a2hhbm5hOnlvdWtoYW5uYQ==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic eW91a2hhbm5hOnlvdWtoYW5uYQ==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "89e833c27178b121eec83f97f167a85e783ab753", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic eW91a2hhbm5hOnlvdWtoYW5uYQ==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic eW91a2hhbm5hOnlvdWtoYW5uYQ==", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic eW91a2hhbm5hOnlvdWtoYW5uYQ==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic eW91a2hhbm5hOnlvdWtoYW5uYQ==", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 84 }
26/07/2026 00:23:57 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 61, "payload_entropy": 4.101804756372095, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "131fe686910d3e215f286d7443ffba46", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "45252375c8373c75ddafaace7aff99ec5fde2762", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
26/07/2026 00:23:49 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YWJjOmFiYw== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YWJjOmFiYw== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 104, "payload_entropy": 5.081020098670791, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6e3aabc6c3434abd465bb908f8be15d7", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWJjOmFiYw==\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWJjOmFiYw==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWJjOmFiYw==", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWJjOmFiYw==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWJjOmFiYw==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b8b47fe87f00d97b3cd6d365135e09feca551413", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWJjOmFiYw==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWJjOmFiYw==", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWJjOmFiYw==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWJjOmFiYw==", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
26/07/2026 00:23:32 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YWRtaW46emh1MTIz Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YWRtaW46emh1MTIz Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 108, "payload_entropy": 5.078270257191567, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "eee856b5f222cace3c44c66259fda9d0", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46emh1MTIz\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46emh1MTIz\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46emh1MTIz", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46emh1MTIz\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46emh1MTIz", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "28d4671fcac5d1760f927317c1482e587d0f54c6", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46emh1MTIz", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46emh1MTIz", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46emh1MTIz", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46emh1MTIz", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
26/07/2026 00:23:27 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dXNlcjE6cGFzczE= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dXNlcjE6cGFzczE= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 108, "payload_entropy": 5.067905299054867, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "30fc125cc633ac947b297d778f178dd2", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bb3841f31a7d8766d930f00e9b3b90a1d77c4d63", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
26/07/2026 00:23:24 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 36, "payload_entropy": 4.006749918638778, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d3b1103b4c2d66de5ec9ef428e03ecd0", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "008fdc98847d653e931fc80f2eea3b249782dc19", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
26/07/2026 00:23:09 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 36, "payload_entropy": 4.006749918638778, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d3b1103b4c2d66de5ec9ef428e03ecd0", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "008fdc98847d653e931fc80f2eea3b249782dc19", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
26/07/2026 00:23:03 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 112, "payload_entropy": 5.100065887173304, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ed3536826f60caccdcc23935c061eeda", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fe5135babf5021cd8044204ff388cafe33f6c78f", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
26/07/2026 00:22:49 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 36, "payload_entropy": 4.006749918638778, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d3b1103b4c2d66de5ec9ef428e03ecd0", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "008fdc98847d653e931fc80f2eea3b249782dc19", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
26/07/2026 00:22:48 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDpnb2RsaWtl Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDpnb2RsaWtl Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 108, "payload_entropy": 5.124599308836478, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c7a10a12b48f2d90a147133b122ad640", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpnb2RsaWtl\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpnb2RsaWtl\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpnb2RsaWtl", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpnb2RsaWtl\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpnb2RsaWtl", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "170fe29901d5e639e9fc912a51c47132b1d4ab5d", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpnb2RsaWtl", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpnb2RsaWtl", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpnb2RsaWtl", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpnb2RsaWtl", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
26/07/2026 00:22:45 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YWRtaW46QWRtaW4= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YWRtaW46QWRtaW4= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 108, "payload_entropy": 5.02540446140873, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2e8712ca4529ac7afa92de3539d4ce68", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW4=\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW4=", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW4=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5ce77ca31ee6b5369127497dbf93031b8ede26f9", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW4=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW4=", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW4=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46QWRtaW4=", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
26/07/2026 00:22:34 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dGVzdDp0ZXN0 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dGVzdDp0ZXN0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 104, "payload_entropy": 5.013383581398133, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4d15cc8a7b81070488f61a282050f4dd", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "70992e142a7fbe62342a713a062f40eb76d74929", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 23:20:01 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YmViZXRvOmJlYmV0bw== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.20142203042396, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f67090411d8bdce3fb7bceb30becc138", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b3dfc189971ac09623487bbdb42f0b8bec637827", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 23:17:36 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dGVzdDp0ZXN0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.013383581398133, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4d15cc8a7b81070488f61a282050f4dd", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d998e38c98ac7ed7dee5724eaa58e6f0dfb2872b", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 23:12:27 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic bWF0dDoxMjNxd2U= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.077798531868949, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "08895a9258b7ba4137761973c9738afd", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bWF0dDoxMjNxd2U=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bWF0dDoxMjNxd2U=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bWF0dDoxMjNxd2U=", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bWF0dDoxMjNxd2U=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bWF0dDoxMjNxd2U=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f373a869de7a085ff99704473375e3eea4c33140", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bWF0dDoxMjNxd2U=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bWF0dDoxMjNxd2U=", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 23:09:13 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dGVzdDp0ZXN0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.013383581398133, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4d15cc8a7b81070488f61a282050f4dd", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d998e38c98ac7ed7dee5724eaa58e6f0dfb2872b", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 23:07:12 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YWFhOmNocmlz Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.012564180605755, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8b23c5396bb1f78c69b360a5a0010219", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5c5bd77802e37a40e19f11636053cb097ddb0124", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 23:04:02 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cG9zdG1hc3RlcjpwYXNzd29yZA== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 120, "payload_entropy": 5.244548642162424, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "29cf9a26df9d075d6775c04e4b6662c4", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cG9zdG1hc3RlcjpwYXNzd29yZA==\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cG9zdG1hc3RlcjpwYXNzd29yZA==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cG9zdG1hc3RlcjpwYXNzd29yZA==", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cG9zdG1hc3RlcjpwYXNzd29yZA==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cG9zdG1hc3RlcjpwYXNzd29yZA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "59560a85291a23fce9af8009f23c8b5da6d57779", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cG9zdG1hc3RlcjpwYXNzd29yZA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cG9zdG1hc3RlcjpwYXNzd29yZA==", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 23:02:09 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.140530788741515, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "83cb3ac921948abf88c7120f4072535c", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3f0f480206094ba615bf0feb19b48125ba7b566b", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:58:49 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.006885942890212, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8aab23002132c4337d5806783098820a", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "37a3a549a6ad493e10b039f4a5b716a769a85daa", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:57:10 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YmViZXRvOmJlYmV0bw== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.20142203042396, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f67090411d8bdce3fb7bceb30becc138", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b3dfc189971ac09623487bbdb42f0b8bec637827", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:54:06 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.140530788741515, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "83cb3ac921948abf88c7120f4072535c", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3f0f480206094ba615bf0feb19b48125ba7b566b", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:52:29 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.006885942890212, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8aab23002132c4337d5806783098820a", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "37a3a549a6ad493e10b039f4a5b716a769a85daa", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:49:01 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YWFhOmNocmlz Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.012564180605755, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8b23c5396bb1f78c69b360a5a0010219", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5c5bd77802e37a40e19f11636053cb097ddb0124", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:43:52 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.091336369060024, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1516da15dac42456c9f9f863eed98cbe", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3d0967b20f1f17fd32263b0bc6da2039cabd85d1", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:42:09 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 61, "payload_entropy": 4.101804756372095, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "131fe686910d3e215f286d7443ffba46", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c89a690d301d458be04f997426cca4e1c233c458", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:31:09 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.006885942890212, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "0c0954cdce540ed9325a47b2f440741029dd389c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8aab23002132c4337d5806783098820a", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0cdf4996c76ee63bc0934d664965cca995d54190", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:26:27 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDp3c3g0NDQ= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.094014734873701, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "0c0954cdce540ed9325a47b2f440741029dd389c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5737522b8323bd569ddfef1203dd3f02", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "58597c37eb9e2492133caec4641ef6f208213a5e", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:21:28 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic MTIzNDU6MTIzNDU= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.018414762314623, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "0c0954cdce540ed9325a47b2f440741029dd389c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "25e235ceb675d3b6e842e1895bad003c", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "011c6d7b2c2400923a67786a659ea1169ee39044", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:16:47 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic Z3Vlc3Q6MTIzNDU2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.069043753280923, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "0c0954cdce540ed9325a47b2f440741029dd389c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0f53e817a8b564e6c8dacb751a96aec2", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MTIzNDU2\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MTIzNDU2\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MTIzNDU2", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MTIzNDU2\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MTIzNDU2", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0eaf76e2583fb81a39e1151863120156867f9537", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MTIzNDU2", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MTIzNDU2", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:11:43 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 63, "payload_entropy": 4.1189519479925325, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "0c0954cdce540ed9325a47b2f440741029dd389c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e9603ed05e8da3e4e245958d98e90356", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ebcde812c152ab4f224d07d71e4f08e84f7e98c6", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:06:51 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDpIYXBweXR1Z3NiYWtlcnkyMDIwIw== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 128, "payload_entropy": 5.411411523723004, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "0c0954cdce540ed9325a47b2f440741029dd389c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5df829b1fe81b2af1a95a5623971a1b7", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpIYXBweXR1Z3NiYWtlcnkyMDIwIw==\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpIYXBweXR1Z3NiYWtlcnkyMDIwIw==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpIYXBweXR1Z3NiYWtlcnkyMDIwIw==", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpIYXBweXR1Z3NiYWtlcnkyMDIwIw==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpIYXBweXR1Z3NiYWtlcnkyMDIwIw==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2c0d55a22594bf4d3551f97ff02329a7bbb86d4e", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpIYXBweXR1Z3NiYWtlcnkyMDIwIw==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpIYXBweXR1Z3NiYWtlcnkyMDIwIw==", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:01:59 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDo3 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 100, "payload_entropy": 4.968465630737975, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "0c0954cdce540ed9325a47b2f440741029dd389c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a2516bc92ebf9ab13bb2b4017e0d4ce8", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo3\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo3\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo3", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo3\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo3", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e615126f04f276e9521a3e1245198942b32cd502", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo3", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo3", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 21:57:07 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDoxMjM0YXNkZnp4Y3Y= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 116, "payload_entropy": 5.256784556818127, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "0c0954cdce540ed9325a47b2f440741029dd389c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cf3f7753232895eea0533885ffd454d5", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0YXNkZnp4Y3Y=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0YXNkZnp4Y3Y=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0YXNkZnp4Y3Y=", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0YXNkZnp4Y3Y=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0YXNkZnp4Y3Y=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0b4f865d9b1be8ce05a53b0e986e513890705cf7", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0YXNkZnp4Y3Y=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0YXNkZnp4Y3Y=", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 10:41:11 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dGVzdDp0ZXN0 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dGVzdDp0ZXN0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 102, "payload_entropy": 5.015919329955861, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f0c3f1640ebd5d3d51acbe6cee843f60", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ed4d02633d0d6a3c4d8be7f553ebbb14e6c350fc", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 10:39:04 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dGVzdDpxMXcyZTNyNA== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dGVzdDpxMXcyZTNyNA== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 110, "payload_entropy": 5.156956959602823, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a1ad463a6efc72cfbd28a2daebe8ed04", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDpxMXcyZTNyNA==\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDpxMXcyZTNyNA==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDpxMXcyZTNyNA==", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDpxMXcyZTNyNA==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDpxMXcyZTNyNA==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c85f17d5e0a9ec8faea6e84caa677443178879bf", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDpxMXcyZTNyNA==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDpxMXcyZTNyNA==", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDpxMXcyZTNyNA==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDpxMXcyZTNyNA==", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 2, "behavior_priority": 84 }
15/07/2026 10:36:57 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 36, "payload_entropy": 4.006749918638778, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d3b1103b4c2d66de5ec9ef428e03ecd0", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "008fdc98847d653e931fc80f2eea3b249782dc19", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 10:34:45 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDpJbkNsMHVk Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDpJbkNsMHVk Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 106, "payload_entropy": 5.17179813911138, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ca6ccd4fc6d6c25d5a4e1dcdd5d20063", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpJbkNsMHVk\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpJbkNsMHVk\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpJbkNsMHVk", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpJbkNsMHVk\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpJbkNsMHVk", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1979d428b4cfa089a469de8de11deb3965b3822c", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpJbkNsMHVk", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpJbkNsMHVk", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpJbkNsMHVk", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpJbkNsMHVk", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 10:32:31 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 114, "payload_entropy": 5.225955449620195, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d46def4d1bc2185b11e426736f450da1", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ==\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ==", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "60593620a3066a0beb1cd9f67b8c88e5f68ecbe4", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ==", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ==", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 10:30:19 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 112, "payload_entropy": 5.091336369060024, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1516da15dac42456c9f9f863eed98cbe", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "facfc8ad3663788748b0778cc17b75ec9872ce06", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 10:24:06 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic M3Byb3h5Og== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic M3Byb3h5Og== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 102, "payload_entropy": 5.018657666173438, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6cd7ccaf42350ccc92e68494f1d30939", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic M3Byb3h5Og==\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic M3Byb3h5Og==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic M3Byb3h5Og==", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic M3Byb3h5Og==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic M3Byb3h5Og==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1b846807d13f1440a973dd4bc1a38969c9b04b9c", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic M3Byb3h5Og==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic M3Byb3h5Og==", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic M3Byb3h5Og==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic M3Byb3h5Og==", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }

102.220.160.38

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence