Renseignement sur les menaces

Slovénie

102.220.160.38

FAI VPS Dedicated LLC Première vue 29/06/2026 07:00 UTC Dernière vue 15/07/2026 23:20 UTC Risque Moyen

Période analysée : 2026-06-19 → 2026-07-19

Activité suspecte · risque 40/100

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 46/100 Moyen

Première observation 29/06/2026 07:00 UTC

Dernière observation 15/07/2026 23:20 UTC

Événements (période) 266

MITRE ATT&CK principal TA0007 244 occurrences

Activité suspecte · risque 40/100

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « web_probe » (signaux protocolaires) · confiance 77%

Confiance 77 % — Score WAF 8

Comparaison ASN / FAI

ASN 197769 · 102.220.160.0/22 · AFRINIC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 266 événements sur la période pour cette IP.

130.12.182.225 Sonde port 19/07/2026 02:51 UTC
130.12.182.224 Sonde port 19/07/2026 00:52 UTC
130.12.182.227 Sonde port 18/07/2026 20:24 UTC
102.220.160.67 Sonde port 18/07/2026 16:46 UTC
102.220.160.29 Sonde port 18/07/2026 10:07 UTC
130.12.182.107 Sonde port 18/07/2026 05:30 UTC
102.220.160.26 Sonde SSH 18/07/2026 04:04 UTC
102.220.160.39 Sonde SSH 18/07/2026 03:53 UTC

Événements (filtres)

266

Première observation

29/06/2026 07:00 UTC

Dernière observation

15/07/2026 23:20 UTC

Dernière activité (filtres)

15/07/2026 23:20 UTC

Événements 7j

116

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 179 SOCKS5 TCP 23 HTTPS TCP 12 HDFS NAMENODE TCP 10 CONSUL WAN TCP 7 SQUID TCP 7

HTTP

179

SOCKS5

HTTPS

HDFS NAMENODE

CONSUL WAN

SQUID

Géolocalisation

Origine réseau déclarée

Slovénie unknown unknown

FAI / réseau

Opérateur et dernière activité ban

VPS Dedicated LLC 0 Port 9080 web_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80

Détails protocole

Méthode: CONNECT
Chemin: 102.220.160.38:80

Aperçu payload

CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YmViZXRvOmJlYmV0bw==

Port / service

9080 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 77 % — Score WAF 8

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Confiance

77%

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

266 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

266 événement(s) — page 1/6

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
15/07/2026 23:20:01 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YmViZXRvOmJlYmV0bw== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.20142203042396, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f67090411d8bdce3fb7bceb30becc138", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b3dfc189971ac09623487bbdb42f0b8bec637827", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 23:17:36 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dGVzdDp0ZXN0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.013383581398133, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4d15cc8a7b81070488f61a282050f4dd", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d998e38c98ac7ed7dee5724eaa58e6f0dfb2872b", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 23:12:27 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic bWF0dDoxMjNxd2U= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.077798531868949, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "08895a9258b7ba4137761973c9738afd", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bWF0dDoxMjNxd2U=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bWF0dDoxMjNxd2U=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bWF0dDoxMjNxd2U=", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bWF0dDoxMjNxd2U=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bWF0dDoxMjNxd2U=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f373a869de7a085ff99704473375e3eea4c33140", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bWF0dDoxMjNxd2U=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bWF0dDoxMjNxd2U=", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 23:09:13 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dGVzdDp0ZXN0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.013383581398133, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4d15cc8a7b81070488f61a282050f4dd", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d998e38c98ac7ed7dee5724eaa58e6f0dfb2872b", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 23:07:12 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YWFhOmNocmlz Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.012564180605755, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8b23c5396bb1f78c69b360a5a0010219", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5c5bd77802e37a40e19f11636053cb097ddb0124", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 23:04:02 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cG9zdG1hc3RlcjpwYXNzd29yZA== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 120, "payload_entropy": 5.244548642162424, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "29cf9a26df9d075d6775c04e4b6662c4", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cG9zdG1hc3RlcjpwYXNzd29yZA==\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cG9zdG1hc3RlcjpwYXNzd29yZA==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cG9zdG1hc3RlcjpwYXNzd29yZA==", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cG9zdG1hc3RlcjpwYXNzd29yZA==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cG9zdG1hc3RlcjpwYXNzd29yZA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "59560a85291a23fce9af8009f23c8b5da6d57779", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cG9zdG1hc3RlcjpwYXNzd29yZA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cG9zdG1hc3RlcjpwYXNzd29yZA==", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 23:02:09 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.140530788741515, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "83cb3ac921948abf88c7120f4072535c", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3f0f480206094ba615bf0feb19b48125ba7b566b", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:58:49 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.006885942890212, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8aab23002132c4337d5806783098820a", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "37a3a549a6ad493e10b039f4a5b716a769a85daa", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:57:10 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YmViZXRvOmJlYmV0bw== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.20142203042396, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f67090411d8bdce3fb7bceb30becc138", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b3dfc189971ac09623487bbdb42f0b8bec637827", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YmViZXRvOmJlYmV0bw==", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:54:06 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.140530788741515, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "83cb3ac921948abf88c7120f4072535c", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3f0f480206094ba615bf0feb19b48125ba7b566b", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpQNHNzdzByZDAx", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:52:29 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.006885942890212, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8aab23002132c4337d5806783098820a", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "37a3a549a6ad493e10b039f4a5b716a769a85daa", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:49:01 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YWFhOmNocmlz Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.012564180605755, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8b23c5396bb1f78c69b360a5a0010219", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5c5bd77802e37a40e19f11636053cb097ddb0124", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWFhOmNocmlz", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:43:52 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.091336369060024, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1516da15dac42456c9f9f863eed98cbe", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3d0967b20f1f17fd32263b0bc6da2039cabd85d1", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:42:09 UTC	TCP	9080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:9080 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 9080 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053", "emulator_response_len": 147, "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 61, "payload_entropy": 4.101804756372095, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 9080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7", "event_fingerprint": "064787b4ec0372f159673e2cfbf2b5b02dea62d4", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "131fe686910d3e215f286d7443ffba46", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 9080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c89a690d301d458be04f997426cca4e1c233c458", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 9080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "target_port_label": "9080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:31:09 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.006885942890212, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "0c0954cdce540ed9325a47b2f440741029dd389c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8aab23002132c4337d5806783098820a", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0cdf4996c76ee63bc0934d664965cca995d54190", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:26:27 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDp3c3g0NDQ= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.094014734873701, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "0c0954cdce540ed9325a47b2f440741029dd389c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5737522b8323bd569ddfef1203dd3f02", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "58597c37eb9e2492133caec4641ef6f208213a5e", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:21:28 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic MTIzNDU6MTIzNDU= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.018414762314623, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "0c0954cdce540ed9325a47b2f440741029dd389c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "25e235ceb675d3b6e842e1895bad003c", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "011c6d7b2c2400923a67786a659ea1169ee39044", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:16:47 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic Z3Vlc3Q6MTIzNDU2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.069043753280923, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "0c0954cdce540ed9325a47b2f440741029dd389c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0f53e817a8b564e6c8dacb751a96aec2", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MTIzNDU2\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MTIzNDU2\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MTIzNDU2", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MTIzNDU2\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MTIzNDU2", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0eaf76e2583fb81a39e1151863120156867f9537", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MTIzNDU2", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MTIzNDU2", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:11:43 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 63, "payload_entropy": 4.1189519479925325, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "0c0954cdce540ed9325a47b2f440741029dd389c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e9603ed05e8da3e4e245958d98e90356", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ebcde812c152ab4f224d07d71e4f08e84f7e98c6", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:06:51 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDpIYXBweXR1Z3NiYWtlcnkyMDIwIw== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 128, "payload_entropy": 5.411411523723004, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "0c0954cdce540ed9325a47b2f440741029dd389c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5df829b1fe81b2af1a95a5623971a1b7", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpIYXBweXR1Z3NiYWtlcnkyMDIwIw==\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpIYXBweXR1Z3NiYWtlcnkyMDIwIw==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpIYXBweXR1Z3NiYWtlcnkyMDIwIw==", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpIYXBweXR1Z3NiYWtlcnkyMDIwIw==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpIYXBweXR1Z3NiYWtlcnkyMDIwIw==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2c0d55a22594bf4d3551f97ff02329a7bbb86d4e", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpIYXBweXR1Z3NiYWtlcnkyMDIwIw==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpIYXBweXR1Z3NiYWtlcnkyMDIwIw==", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 22:01:59 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDo3 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 100, "payload_entropy": 4.968465630737975, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "0c0954cdce540ed9325a47b2f440741029dd389c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a2516bc92ebf9ab13bb2b4017e0d4ce8", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo3\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo3\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo3", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo3\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo3", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e615126f04f276e9521a3e1245198942b32cd502", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo3", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDo3", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 21:57:07 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDoxMjM0YXNkZnp4Y3Y= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 116, "payload_entropy": 5.256784556818127, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "0c0954cdce540ed9325a47b2f440741029dd389c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cf3f7753232895eea0533885ffd454d5", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0YXNkZnp4Y3Y=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0YXNkZnp4Y3Y=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0YXNkZnp4Y3Y=", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0YXNkZnp4Y3Y=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0YXNkZnp4Y3Y=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0b4f865d9b1be8ce05a53b0e986e513890705cf7", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0YXNkZnp4Y3Y=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDoxMjM0YXNkZnp4Y3Y=", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 10:41:11 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dGVzdDp0ZXN0 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dGVzdDp0ZXN0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 102, "payload_entropy": 5.015919329955861, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f0c3f1640ebd5d3d51acbe6cee843f60", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ed4d02633d0d6a3c4d8be7f553ebbb14e6c350fc", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 10:39:04 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dGVzdDpxMXcyZTNyNA== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dGVzdDpxMXcyZTNyNA== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 110, "payload_entropy": 5.156956959602823, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a1ad463a6efc72cfbd28a2daebe8ed04", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDpxMXcyZTNyNA==\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDpxMXcyZTNyNA==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDpxMXcyZTNyNA==", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDpxMXcyZTNyNA==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDpxMXcyZTNyNA==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c85f17d5e0a9ec8faea6e84caa677443178879bf", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDpxMXcyZTNyNA==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDpxMXcyZTNyNA==", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDpxMXcyZTNyNA==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDpxMXcyZTNyNA==", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 2, "behavior_priority": 84 }
15/07/2026 10:36:57 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 36, "payload_entropy": 4.006749918638778, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d3b1103b4c2d66de5ec9ef428e03ecd0", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "008fdc98847d653e931fc80f2eea3b249782dc19", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 10:34:45 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDpJbkNsMHVk Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDpJbkNsMHVk Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 106, "payload_entropy": 5.17179813911138, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ca6ccd4fc6d6c25d5a4e1dcdd5d20063", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpJbkNsMHVk\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpJbkNsMHVk\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpJbkNsMHVk", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpJbkNsMHVk\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpJbkNsMHVk", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1979d428b4cfa089a469de8de11deb3965b3822c", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpJbkNsMHVk", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpJbkNsMHVk", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpJbkNsMHVk", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpJbkNsMHVk", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 10:32:31 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 114, "payload_entropy": 5.225955449620195, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d46def4d1bc2185b11e426736f450da1", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ==\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ==", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "60593620a3066a0beb1cd9f67b8c88e5f68ecbe4", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ==", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjI6MTIzNDU2Nzg5YQ==", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 10:30:19 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 112, "payload_entropy": 5.091336369060024, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1516da15dac42456c9f9f863eed98cbe", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "facfc8ad3663788748b0778cc17b75ec9872ce06", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 10:24:06 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic M3Byb3h5Og== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic M3Byb3h5Og== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 102, "payload_entropy": 5.018657666173438, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6cd7ccaf42350ccc92e68494f1d30939", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic M3Byb3h5Og==\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic M3Byb3h5Og==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic M3Byb3h5Og==", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic M3Byb3h5Og==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic M3Byb3h5Og==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1b846807d13f1440a973dd4bc1a38969c9b04b9c", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic M3Byb3h5Og==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic M3Byb3h5Og==", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic M3Byb3h5Og==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic M3Byb3h5Og==", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 10:21:59 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dXNlcjoxMjM= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dXNlcjoxMjM= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 104, "payload_entropy": 5.031794949836525, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d5be90beaa15411c040edf6dcd16c49f", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjoxMjM=\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjoxMjM=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjoxMjM=", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjoxMjM=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjoxMjM=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cc96f80c384710b87a13bf25691788460cf019be", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjoxMjM=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjoxMjM=", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjoxMjM=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dXNlcjoxMjM=", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 84 }
15/07/2026 10:19:57 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 36, "payload_entropy": 4.006749918638778, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d3b1103b4c2d66de5ec9ef428e03ecd0", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "008fdc98847d653e931fc80f2eea3b249782dc19", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 10:17:49 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic c3BhbWZpbHRlcjpzdGVhbTEyMw== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic c3BhbWZpbHRlcjpzdGVhbTEyMw== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 118, "payload_entropy": 5.291932431225773, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e46bda10dde878d8a0240a63bd1a4656", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic c3BhbWZpbHRlcjpzdGVhbTEyMw==\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic c3BhbWZpbHRlcjpzdGVhbTEyMw==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic c3BhbWZpbHRlcjpzdGVhbTEyMw==", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic c3BhbWZpbHRlcjpzdGVhbTEyMw==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic c3BhbWZpbHRlcjpzdGVhbTEyMw==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7706b3981989cce8253f7f4a68d0e5f3566c6675", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic c3BhbWZpbHRlcjpzdGVhbTEyMw==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic c3BhbWZpbHRlcjpzdGVhbTEyMw==", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic c3BhbWZpbHRlcjpzdGVhbTEyMw==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic c3BhbWZpbHRlcjpzdGVhbTEyMw==", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 72 }
15/07/2026 09:24:04 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 132, "payload_entropy": 5.350192242929271, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "4336d34a0cb84ad2f8d993879aab37d1f3ad2026", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "250acde3006e456eca928276403fb31c", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "64a6cc1849a1f40c12cb1157fc567ee59373916e", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 09:21:59 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cHJveHk6cHJveHk= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.013733162675878, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "4336d34a0cb84ad2f8d993879aab37d1f3ad2026", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "36867870cd5e5dc7603ce985e7f325a3", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cHJveHk6cHJveHk=\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cHJveHk6cHJveHk=\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cHJveHk6cHJveHk=", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cHJveHk6cHJveHk=\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cHJveHk6cHJveHk=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6b70f94ac72ed7ba24b7bba31c31b2d5affa33f6", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cHJveHk6cHJveHk=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cHJveHk6cHJveHk=", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 09:19:44 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic MTIzOjQ1Ng== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 102, "payload_entropy": 5.019636739409811, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "4336d34a0cb84ad2f8d993879aab37d1f3ad2026", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6474f399800648dd16a21f190b2ebac9", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c573f5308d5dde8f460fddf65188d2f21e0e0f0f", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 09:17:38 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YWRtaW46MjMwMjg0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.078071078415822, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "4336d34a0cb84ad2f8d993879aab37d1f3ad2026", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "45e6acd2ef5f2bc7286075a0fae71481", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46MjMwMjg0\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46MjMwMjg0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46MjMwMjg0", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46MjMwMjg0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46MjMwMjg0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d84e68984a8d5f6547ca93c0b3e9e7ef74d0ef9e", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46MjMwMjg0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YWRtaW46MjMwMjg0", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 09:15:33 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDpyb290d2ViMDE= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 110, "payload_entropy": 5.134908837517347, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "4336d34a0cb84ad2f8d993879aab37d1f3ad2026", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f5c95896c4e882bb14d24c7c9d7d886c", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpyb290d2ViMDE=\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpyb290d2ViMDE=\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpyb290d2ViMDE=", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpyb290d2ViMDE=\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpyb290d2ViMDE=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e9674a343a5e8323a1ec4d32ba537b8fc46f8ed2", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpyb290d2ViMDE=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpyb290d2ViMDE=", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 09:13:25 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 36, "payload_entropy": 4.006749918638778, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "4336d34a0cb84ad2f8d993879aab37d1f3ad2026", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d3b1103b4c2d66de5ec9ef428e03ecd0", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "db2eb191eb937b32047d5bcd3241bf9f1e8b2cae", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 09:11:17 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDpxd2VyMTIzQA== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 110, "payload_entropy": 5.198894941894525, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "4336d34a0cb84ad2f8d993879aab37d1f3ad2026", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "fbe7adf772ca91e2c7a42ec04df06499", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpxd2VyMTIzQA==\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpxd2VyMTIzQA==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpxd2VyMTIzQA==", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpxd2VyMTIzQA==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpxd2VyMTIzQA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "12d11cb8a2ff998e7cfe28b98977c61efd20f602", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpxd2VyMTIzQA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpxd2VyMTIzQA==", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 72 }
15/07/2026 09:09:14 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDpxYXp3c3gh Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.125911433374221, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "4336d34a0cb84ad2f8d993879aab37d1f3ad2026", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "14ed8ca4103fe90691901ec01425f201", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpxYXp3c3gh\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpxYXp3c3gh\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpxYXp3c3gh", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpxYXp3c3gh\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpxYXp3c3gh", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "54aa310b9aea62791e724c70c1d086e11a79e1b5", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpxYXp3c3gh", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpxYXp3c3gh", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 09:07:06 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDp3c3g0NDQ= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.094014734873701, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "4336d34a0cb84ad2f8d993879aab37d1f3ad2026", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5737522b8323bd569ddfef1203dd3f02", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b62c033dc23afd7b861ab9cc90123eb324d330a7", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp3c3g0NDQ=", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 09:05:03 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic MTox Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 96, "payload_entropy": 4.834657491352945, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "4336d34a0cb84ad2f8d993879aab37d1f3ad2026", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "625ff8bc53e35a412b6e830be2b77950", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTox\r\n\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTox\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTox", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTox\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTox", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bb69733071addc79dd76b8fef6c5419c1d988fe2", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTox", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTox", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 09:02:55 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic YTph Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 94, "payload_entropy": 4.874488687536801, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "4336d34a0cb84ad2f8d993879aab37d1f3ad2026", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ba25b02635589dd6d2802b2667dd60a", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YTph\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YTph\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YTph", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YTph\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YTph", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3bdcf3b19d94feb1289fc9b3789da4ea64ee04bc", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YTph", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic YTph", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 84 }
15/07/2026 09:00:43 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 102.220.160.38:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 102.220.160.38:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 102.220.160.38:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 102.220.160.38:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 102.220.160.38:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dGVzdDoxMjM0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "38:80", "http_ua_hash": null, "http_host_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_target_hash": "8cf508787c3ae6b4c637468eaf806c5eb93fc2ce", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 102, "payload_entropy": 5.015720446464325, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "4336d34a0cb84ad2f8d993879aab37d1f3ad2026", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e7caa407d8a65bd4b8dfc04bb86b82ed", "path_pattern_hash": "83d67f94c2588729feaaceccdd2094d3" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0\r\n", "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0", "evidence": { "method": "CONNECT", "path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e2b49375a10a3c3197f9ada043d635a9ac520bdf", "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "102.220.160.38:80", "request_line": "CONNECT 102.220.160.38:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.38:80", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 06:00:34 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic ZnRwdXNlcjox Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic ZnRwdXNlcjox Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 102, "payload_entropy": 5.05429954875579, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c3346d33c5d8b7e270e8a5b41c63c8b9", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic ZnRwdXNlcjox\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic ZnRwdXNlcjox\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic ZnRwdXNlcjox", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic ZnRwdXNlcjox\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic ZnRwdXNlcjox", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9b4612c897d7384733e7f2ecb4dedd998bd3a2cd", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic ZnRwdXNlcjox", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic ZnRwdXNlcjox", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic ZnRwdXNlcjox", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic ZnRwdXNlcjox", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 05:58:35 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDpyb290 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDpyb290 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 102, "payload_entropy": 5.030111927095311, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f54dc26a59fd8b8dce7c4d2f66d35efc", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpyb290", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpyb290", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a26ec656a6844fc842e0763041df00c27bd78142", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpyb290", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpyb290", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpyb290", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDpyb290", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 05:56:39 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dGVzdDox Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic dGVzdDox Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 100, "payload_entropy": 4.956014505759609, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f9b3eb9e581a2cef5e2149d203358452", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDox\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDox\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDox", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDox\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDox", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5f12e4a3b2aa8f90b9682618e95de8ca4ac50d9a", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDox", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDox", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDox", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic dGVzdDox", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 05:54:50 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDp0ZXJyYXJpYXNlcnZlckAxMjM= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic cm9vdDp0ZXJyYXJpYXNlcnZlckAxMjM= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 124, "payload_entropy": 5.346339384037721, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1e7687aaed2f67b34fa4a18485d68bb1", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp0ZXJyYXJpYXNlcnZlckAxMjM=\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp0ZXJyYXJpYXNlcnZlckAxMjM=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp0ZXJyYXJpYXNlcnZlckAxMjM=", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp0ZXJyYXJpYXNlcnZlckAxMjM=\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp0ZXJyYXJpYXNlcnZlckAxMjM=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2dbe9e70f2dbdf3263708355a5c2303faa3efc9d", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp0ZXJyYXJpYXNlcnZlckAxMjM=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp0ZXJyYXJpYXNlcnZlckAxMjM=", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp0ZXJyYXJpYXNlcnZlckAxMjM=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic cm9vdDp0ZXJyYXJpYXNlcnZlckAxMjM=", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 05:52:50 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic c3ZuOnN2bjEyMw== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic c3ZuOnN2bjEyMw== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 106, "payload_entropy": 5.064375290546166, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bf11b5d4ecc1d4ffd6fed46c950e36bd", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic c3ZuOnN2bjEyMw==\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic c3ZuOnN2bjEyMw==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic c3ZuOnN2bjEyMw==", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic c3ZuOnN2bjEyMw==\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic c3ZuOnN2bjEyMw==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c5b497aef91ac87e14a307ab751114d452aa13d7", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic c3ZuOnN2bjEyMw==", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic c3ZuOnN2bjEyMw==", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic c3ZuOnN2bjEyMw==", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic c3ZuOnN2bjEyMw==", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 05:51:00 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic MTExOjExMQ== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 102.220.160.38:80 HTTP/1.0 Host: 102.220.160.38:80 Proxy-Authorization: Basic MTExOjExMQ== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 104, "payload_entropy": 4.989579954398416, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "83d13d1b37c5c751ea533561c7fca995", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTExOjExMQ==\r\n\r\n", "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTExOjExMQ==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTExOjExMQ==", "evidence": { "request_sample": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTExOjExMQ==\r\n\r\n", "payload_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTExOjExMQ==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a392d7c2ed96adb1539578af6eee02f4b8e7556e", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTExOjExMQ==", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTExOjExMQ==", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTExOjExMQ==", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 102.220.160.38:80 HTTP\/1.0\r\nHost: 102.220.160.38:80\r\nProxy-Authorization: Basic MTExOjExMQ==", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }

102.220.160.38

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence