|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���*�>�k�5�Uh)� �H�5=5I���F ��|� D���D3�
�G��;/� K�R2t T�T �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ���*�>�k�5�Uh)� �H�5=5I���F ��|� D���D3� �G��;/� K�R2t T�T �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 �:: 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "053f8e2a202ea288d2211b51327ceb79",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 439,
"payload_entropy": 5.969688355831181,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "d10786aeed9d67d975680f8bbc2779723cd8297b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "053f8e2a202ea288d2211b51327ceb79",
"payload_hash": "bf9b7de07eb7118fe592c946b39fc79d",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd*\ufffd>\ufffdk\ufffd5\ufffdUh)\ufffd\t\ufffd\u0010H\ufffd5=5I\ufffd\ufffd\ue150\u0017\ufffdF \ufffd\ufffd\u0016|\ufffd\u001c\u0005D\ufffd\ufffd\ufffdD3\ufffd\r\ufffdG\ufffd\ufffd;\/\ufffd\u0000K\ufffdR2t\u001fT\ufffdT\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd*\ufffd>\ufffdk\ufffd5\ufffdUh)\ufffd\t\ufffd\u0010H\ufffd5=5I\ufffd\ufffd\ue150\u0017\ufffdF \ufffd\ufffd\u0016|\ufffd\u001c\u0005D\ufffd\ufffd\ufffdD3\ufffd\r\ufffdG\ufffd\ufffd;\/\ufffd\u0000K\ufffdR2t\u001fT\ufffdT\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd::\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd*\ufffd>\ufffdk\ufffd5\ufffdUh)\ufffd\t\ufffd\u0010H\ufffd5=5I\ufffd\ufffd\ue150\u0017\ufffdF \ufffd\ufffd\u0016|\ufffd\u001c\u0005D\ufffd\ufffd\ufffdD3\ufffd\r\ufffdG\ufffd\ufffd;\/\ufffd\u0000K\ufffdR2t\u001fT\ufffdT\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd*\ufffd>\ufffdk\ufffd5\ufffdUh)\ufffd\t\ufffd\u0010H\ufffd5=5I\ufffd\ufffd\ue150\u0017\ufffdF \ufffd\ufffd\u0016|\ufffd\u001c\u0005D\ufffd\ufffd\ufffdD3\ufffd\r\ufffdG\ufffd\ufffd;\/\ufffd\u0000K\ufffdR2t\u001fT\ufffdT\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd::\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd*\ufffd>\ufffdk\ufffd5\ufffdUh)\ufffd\t\ufffd\u0010H\ufffd5=5I\ufffd\ufffd\ue150\u0017\ufffdF \ufffd\ufffd\u0016|\ufffd\u001c\u0005D\ufffd\ufffd\ufffdD3\ufffd\r\ufffdG\ufffd\ufffd;\/\ufffd\u0000K\ufffdR2t\u001fT\ufffdT\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "df86d1a40a05ee32899a0448b0a7198e6e2fe703",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��]4� ��A�BN��ϩ{�үp�8�[[6�J�G �6p�� ��m��V�6�ŭ͞00I��)�� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ��]4� ��A�BN��ϩ{�үp�8�[[6�J�G �6p�� ��m��V�6�ŭ͞00I��)�� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 �JJ 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "edcedd20a7451193e8ce5f328ab955b4",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 412,
"payload_entropy": 6.029706812117898,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "4a97d681d9ada58614795873b5d0ee5dd2644103",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "edcedd20a7451193e8ce5f328ab955b4",
"payload_hash": "c69b200ea833a6d8d184061d832945fb",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd]4\ufffd\u001f\ufffd\ufffdA\u0006\ufffdBN\ufffd\ufffd\u03e9{\ufffd\u04afp\ufffd8\ufffd\u0011[[6\ufffdJ\ufffdG \ufffd6p\ufffd\ufffd\t\ufffd\ufffd\u0003\u0015m\ufffd\ufffdV\ufffd6\ufffd\u016d\u035e00I\ufffd\ufffd)\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd]4\ufffd\u001f\ufffd\ufffdA\u0006\ufffdBN\ufffd\ufffd\u03e9{\ufffd\u04afp\ufffd8\ufffd\u0011[[6\ufffdJ\ufffdG \ufffd6p\ufffd\ufffd\t\ufffd\ufffd\u0003\u0015m\ufffd\ufffdV\ufffd6\ufffd\u016d\u035e00I\ufffd\ufffd)\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffdJJ\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd]4\ufffd\u001f\ufffd\ufffdA\u0006\ufffdBN\ufffd\ufffd\u03e9{\ufffd\u04afp\ufffd8\ufffd\u0011[[6\ufffdJ\ufffdG \ufffd6p\ufffd\ufffd\t\ufffd\ufffd\u0003\u0015m\ufffd\ufffdV\ufffd6\ufffd\u016d\u035e00I\ufffd\ufffd)\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd]4\ufffd\u001f\ufffd\ufffdA\u0006\ufffdBN\ufffd\ufffd\u03e9{\ufffd\u04afp\ufffd8\ufffd\u0011[[6\ufffdJ\ufffdG \ufffd6p\ufffd\ufffd\t\ufffd\ufffd\u0003\u0015m\ufffd\ufffdV\ufffd6\ufffd\u016d\u035e00I\ufffd\ufffd)\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffdJJ\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd]4\ufffd\u001f\ufffd\ufffdA\u0006\ufffdBN\ufffd\ufffd\u03e9{\ufffd\u04afp\ufffd8\ufffd\u0011[[6\ufffdJ\ufffdG \ufffd6p\ufffd\ufffd\t\ufffd\ufffd\u0003\u0015m\ufffd\ufffdV\ufffd6\ufffd\u016d\u035e00I\ufffd\ufffd)\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c1b09aaad1a4acab40230bde27c87f8c8d80f654",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� � ��c� ��+
kZ_(m ��c��m����Z4*� �"���l�
�,#��G������Q^��� WP��� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� � ��c� ��+ kZ_(m ��c��m����Z4*� �"���l� �,#��G������Q^��� WP��� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 413,
"payload_entropy": 6.0568732456510945,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "bfe7ebd9eacb175e5a75eef65d0215e1d2e6cdfe",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "006315b3ad276906ff11527f9594e5ba",
"payload_hash": "584924bcb85b045fd66ac1e8c408b484",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\t\ufffd\ufffd\bc\ufffd\u001d\ufffd\ufffd+\nkZ_(m\u001e\ufffd\ufffdc\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffdZ4*\ufffd \ufffd\"\ufffd\ufffd\ufffdl\ufffd\n\ufffd,#\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ^\ufffd\ufffd\ufffd\u001fWP\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\t\ufffd\ufffd\bc\ufffd\u001d\ufffd\ufffd+\nkZ_(m\u001e\ufffd\ufffdc\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffdZ4*\ufffd \ufffd\"\ufffd\ufffd\ufffdl\ufffd\n\ufffd,#\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ^\ufffd\ufffd\ufffd\u001fWP\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\t\ufffd\ufffd\bc\ufffd\u001d\ufffd\ufffd+\nkZ_(m\u001e\ufffd\ufffdc\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffdZ4*\ufffd \ufffd\"\ufffd\ufffd\ufffdl\ufffd\n\ufffd,#\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ^\ufffd\ufffd\ufffd\u001fWP\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\t\ufffd\ufffd\bc\ufffd\u001d\ufffd\ufffd+\nkZ_(m\u001e\ufffd\ufffdc\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffdZ4*\ufffd \ufffd\"\ufffd\ufffd\ufffdl\ufffd\n\ufffd,#\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ^\ufffd\ufffd\ufffd\u001fWP\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\t\ufffd\ufffd\bc\ufffd\u001d\ufffd\ufffd+\nkZ_(m\u001e\ufffd\ufffdc\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffdZ4*\ufffd \ufffd\"\ufffd\ufffd\ufffdl\ufffd\n\ufffd,#\ufffd\ufffdG\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ^\ufffd\ufffd\ufffd\u001fWP\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "607c72980886ae54d25387638bf55cb9d708bcbf",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �Kd�*�8�}%�Ɉ����z.N������n$GR �bz3+ �~Mwɹ�
M��C�.| ~`��fA�� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �Kd�*�8�}%�Ɉ����z.N������n$GR �bz3+ �~Mwɹ� M��C�.| ~`��fA�� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 426,
"payload_entropy": 6.015203120746466,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "06a993f526a777a685a1b81767103c0a",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003Kd\ufffd*\ufffd8\ufffd}%\ufffd\u0248\ufffd\ufffd\ufffd\ufffdz.N\ufffd\u0012\ufffd\ufffd\ufffd\ufffd\ufffd\u0011n$G\u001aR \u0007\ufffdbz3+\u0000\ufffd~Mw\u0279\ufffd\rM\u0016\ufffd\ufffdC\ufffd.|\u001c~`\ufffd\ufffdfA\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003Kd\ufffd*\ufffd8\ufffd}%\ufffd\u0248\ufffd\ufffd\ufffd\ufffdz.N\ufffd\u0012\ufffd\ufffd\ufffd\ufffd\ufffd\u0011n$G\u001aR \u0007\ufffdbz3+\u0000\ufffd~Mw\u0279\ufffd\rM\u0016\ufffd\ufffdC\ufffd.|\u001c~`\ufffd\ufffdfA\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003Kd\ufffd*\ufffd8\ufffd}%\ufffd\u0248\ufffd\ufffd\ufffd\ufffdz.N\ufffd\u0012\ufffd\ufffd\ufffd\ufffd\ufffd\u0011n$G\u001aR \u0007\ufffdbz3+\u0000\ufffd~Mw\u0279\ufffd\rM\u0016\ufffd\ufffdC\ufffd.|\u001c~`\ufffd\ufffdfA\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003Kd\ufffd*\ufffd8\ufffd}%\ufffd\u0248\ufffd\ufffd\ufffd\ufffdz.N\ufffd\u0012\ufffd\ufffd\ufffd\ufffd\ufffd\u0011n$G\u001aR \u0007\ufffdbz3+\u0000\ufffd~Mw\u0279\ufffd\rM\u0016\ufffd\ufffdC\ufffd.|\u001c~`\ufffd\ufffdfA\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003Kd\ufffd*\ufffd8\ufffd}%\ufffd\u0248\ufffd\ufffd\ufffd\ufffdz.N\ufffd\u0012\ufffd\ufffd\ufffd\ufffd\ufffd\u0011n$G\u001aR \u0007\ufffdbz3+\u0000\ufffd~Mw\u0279\ufffd\rM\u0016\ufffd\ufffdC\ufffd.|\u001c~`\ufffd\ufffdfA\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b3ac4f2194eaeadc8329a1f6968ae70cf52091f1",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �e۪�`nuwe j��E��n ^*�vX ���R ~t��f=2�����vW ��iu�y�fb�� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �e۪�`nuwe j��E��n ^*�vX ���R ~t��f=2�����vW ��iu�y�fb�� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 5.970347601958944,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "8660f657ffff341153be847b81313453",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003e\u06ea\ufffd`nuwe\u001cj\ufffd\ufffdE\ufffd\ufffdn\u001f^*\ufffdvX \u001d\ufffd\ufffd\ufffd\u0004R ~t\ufffd\ufffdf=2\ufffd\ufffd\ufffd\ufffd\ufffdvW\u0015\u0012\u0005\t\ufffd\u0019\u000e\ufffdiu\ufffdy\ufffdfb\ufffd\u0006\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003e\u06ea\ufffd`nuwe\u001cj\ufffd\ufffdE\ufffd\ufffdn\u001f^*\ufffdvX \u001d\ufffd\ufffd\ufffd\u0004R ~t\ufffd\ufffdf=2\ufffd\ufffd\ufffd\ufffd\ufffdvW\u0015\u0012\u0005\t\ufffd\u0019\u000e\ufffdiu\ufffdy\ufffdfb\ufffd\u0006\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003e\u06ea\ufffd`nuwe\u001cj\ufffd\ufffdE\ufffd\ufffdn\u001f^*\ufffdvX \u001d\ufffd\ufffd\ufffd\u0004R ~t\ufffd\ufffdf=2\ufffd\ufffd\ufffd\ufffd\ufffdvW\u0015\u0012\u0005\t\ufffd\u0019\u000e\ufffdiu\ufffdy\ufffdfb\ufffd\u0006\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003e\u06ea\ufffd`nuwe\u001cj\ufffd\ufffdE\ufffd\ufffdn\u001f^*\ufffdvX \u001d\ufffd\ufffd\ufffd\u0004R ~t\ufffd\ufffdf=2\ufffd\ufffd\ufffd\ufffd\ufffdvW\u0015\u0012\u0005\t\ufffd\u0019\u000e\ufffdiu\ufffdy\ufffdfb\ufffd\u0006\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003e\u06ea\ufffd`nuwe\u001cj\ufffd\ufffdE\ufffd\ufffdn\u001f^*\ufffdvX \u001d\ufffd\ufffd\ufffd\u0004R ~t\ufffd\ufffdf=2\ufffd\ufffd\ufffd\ufffd\ufffdvW\u0015\u0012\u0005\t\ufffd\u0019\u000e\ufffdiu\ufffdy\ufffdfb\ufffd\u0006\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a0128f21f3e5020a52f4e253acd98000b68fec34",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �����-�-��R����2VED�"����ArA � ������~����@�r �w��%� �̍� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �����-�-��R����2VED�"����ArA � ������~����@�r �w��%� �̍� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 424,
"payload_entropy": 5.96938211097502,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "226ad82cfeb1daacb9e435536ea56c0c",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0015-\ufffd-\ufffd\ufffdR\ufffd\ufffd\ufffd\ufffd2VED\ufffd\"\ufffd\ufffd\u0002\ufffd\ufffdArA\u0012 \ufffd\u001f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\u0018\u0001\ufffd\ufffd\u001a\ufffd\ufffd@\ufffdr\u000b\ufffdw\ufffd\ufffd\u0019%\ufffd\t\ufffd\u030d\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0015-\ufffd-\ufffd\ufffdR\ufffd\ufffd\ufffd\ufffd2VED\ufffd\"\ufffd\ufffd\u0002\ufffd\ufffdArA\u0012 \ufffd\u001f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\u0018\u0001\ufffd\ufffd\u001a\ufffd\ufffd@\ufffdr\u000b\ufffdw\ufffd\ufffd\u0019%\ufffd\t\ufffd\u030d\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0015-\ufffd-\ufffd\ufffdR\ufffd\ufffd\ufffd\ufffd2VED\ufffd\"\ufffd\ufffd\u0002\ufffd\ufffdArA\u0012 \ufffd\u001f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\u0018\u0001\ufffd\ufffd\u001a\ufffd\ufffd@\ufffdr\u000b\ufffdw\ufffd\ufffd\u0019%\ufffd\t\ufffd\u030d\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0015-\ufffd-\ufffd\ufffdR\ufffd\ufffd\ufffd\ufffd2VED\ufffd\"\ufffd\ufffd\u0002\ufffd\ufffdArA\u0012 \ufffd\u001f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\u0018\u0001\ufffd\ufffd\u001a\ufffd\ufffd@\ufffdr\u000b\ufffdw\ufffd\ufffd\u0019%\ufffd\t\ufffd\u030d\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0015-\ufffd-\ufffd\ufffdR\ufffd\ufffd\ufffd\ufffd2VED\ufffd\"\ufffd\ufffd\u0002\ufffd\ufffdArA\u0012 \ufffd\u001f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd~\u0018\u0001\ufffd\ufffd\u001a\ufffd\ufffd@\ufffdr\u000b\ufffdw\ufffd\ufffd\u0019%\ufffd\t\ufffd\u030d\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a0350ab312bd6cd99f1b64c871dee33e8637f7c6",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �d
���XC�ɺ�H>�FFwA@I��nm� ��� M�f�h"x���Z�O}���9\� �i�3e?J�� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �d ���XC�ɺ�H>�FFwA@I��nm� ��� M�f�h"x���Z�O}���9\� �i�3e?J�� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 6.0034973980546775,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "ee772cdef6427b54bb144b4ac39130f3",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003d\n\u0012\ufffd\ufffd\ufffdXC\ufffd\u027a\ufffdH>\ufffdFFwA@I\ufffd\u0007\ufffdnm\ufffd \ufffd\u000f\ufffd\ufffd M\ufffdf\ufffdh\"x\ufffd\ufffd\ufffdZ\ufffdO}\ufffd\ufffd\ufffd9\\\ufffd\t\ufffdi\u0004\u0002\ufffd3e?J\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003d\n\u0012\ufffd\ufffd\ufffdXC\ufffd\u027a\ufffdH>\ufffdFFwA@I\ufffd\u0007\ufffdnm\ufffd \ufffd\u000f\ufffd\ufffd M\ufffdf\ufffdh\"x\ufffd\ufffd\ufffdZ\ufffdO}\ufffd\ufffd\ufffd9\\\ufffd\t\ufffdi\u0004\u0002\ufffd3e?J\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003d\n\u0012\ufffd\ufffd\ufffdXC\ufffd\u027a\ufffdH>\ufffdFFwA@I\ufffd\u0007\ufffdnm\ufffd \ufffd\u000f\ufffd\ufffd M\ufffdf\ufffdh\"x\ufffd\ufffd\ufffdZ\ufffdO}\ufffd\ufffd\ufffd9\\\ufffd\t\ufffdi\u0004\u0002\ufffd3e?J\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003d\n\u0012\ufffd\ufffd\ufffdXC\ufffd\u027a\ufffdH>\ufffdFFwA@I\ufffd\u0007\ufffdnm\ufffd \ufffd\u000f\ufffd\ufffd M\ufffdf\ufffdh\"x\ufffd\ufffd\ufffdZ\ufffdO}\ufffd\ufffd\ufffd9\\\ufffd\t\ufffdi\u0004\u0002\ufffd3e?J\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003d\n\u0012\ufffd\ufffd\ufffdXC\ufffd\u027a\ufffdH>\ufffdFFwA@I\ufffd\u0007\ufffdnm\ufffd \ufffd\u000f\ufffd\ufffd M\ufffdf\ufffdh\"x\ufffd\ufffd\ufffdZ\ufffdO}\ufffd\ufffd\ufffd9\\\ufffd\t\ufffdi\u0004\u0002\ufffd3e?J\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7ddf70e2c1448da2d86c6cbf1d097541a4a88424",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T P� ` ѱ��D�~��mJb����J�%(d� �|&X��Е\<*S��w��na*����� F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T P� ` ѱ��D�~��mJb����J�%(d� �|&X��Е\<*S��w��na*����� F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 345,
"payload_entropy": 6.163377795876869,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "dba5f6074e75af26ae4ac6bcdf06131c655bc11d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "03a3ad27040f733ee5c9915e0903d028",
"payload_hash": "6487d707fa412737e4bb3d10c386f179",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\u001c\u0002\u001b`\u001d\u0471\ufffd\ufffd\u0015D\ufffd~\ufffd\ufffdmJb\ufffd\u0382\ufffd\ufffd\ufffdJ\ufffd%(d\u0019\ufffd \ufffd|&X\ufffd\ufffd\u0415\u0002\\<*S\ufffd\ufffdw\u0011\ue326\ufffd\ufffdn\u0014a*\ufffd\ufffd\ufffd\ufffd\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\u001c\u0002\u001b`\u001d\u0471\ufffd\ufffd\u0015D\ufffd~\ufffd\ufffdmJb\ufffd\u0382\ufffd\ufffd\ufffdJ\ufffd%(d\u0019\ufffd \ufffd|&X\ufffd\ufffd\u0415\u0002\\<*S\ufffd\ufffdw\u0011\ue326\ufffd\ufffdn\u0014a*\ufffd\ufffd\ufffd\ufffd\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\u001c\u0002\u001b`\u001d\u0471\ufffd\ufffd\u0015D\ufffd~\ufffd\ufffdmJb\ufffd\u0382\ufffd\ufffd\ufffdJ\ufffd%(d\u0019\ufffd \ufffd|&X\ufffd\ufffd\u0415\u0002\\<*S\ufffd\ufffdw\u0011\ue326\ufffd\ufffdn\u0014a*\ufffd\ufffd\ufffd\ufffd\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\u001c\u0002\u001b`\u001d\u0471\ufffd\ufffd\u0015D\ufffd~\ufffd\ufffdmJb\ufffd\u0382\ufffd\ufffd\ufffdJ\ufffd%(d\u0019\ufffd \ufffd|&X\ufffd\ufffd\u0415\u0002\\<*S\ufffd\ufffdw\u0011\ue326\ufffd\ufffdn\u0014a*\ufffd\ufffd\ufffd\ufffd\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffd\u001c\u0002\u001b`\u001d\u0471\ufffd\ufffd\u0015D\ufffd~\ufffd\ufffdmJb\ufffd\u0382\ufffd\ufffd\ufffdJ\ufffd%(d\u0019\ufffd \ufffd|&X\ufffd\ufffd\u0415\u0002\\<*S\ufffd\ufffdw\u0011\ue326\ufffd\ufffdn\u0014a*\ufffd\ufffd\ufffd\ufffd\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "746d46c1a5128b31adcd40ebdb0d6eceb29771c6",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F B��kve� ���I H�'�X��g�T�R�ÄM� PYq��V��E�`�:����#�Û�&�x� D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F B��kve� ���I H�'�X��g�T�R�ÄM� PYq��V��E�`�:����#�Û�&�x� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"tls_ja3_hash": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 11,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2c",
"hq"
],
"bytes_in": 331,
"payload_entropy": 6.023253537022648,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "5ea4964083662cfc7b514c9c02916c805265a734",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a96dc3876784813c57d302241e620acd",
"payload_hash": "de383b9bfe6289abdd3e410a21e0fe3a",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffdkv\u0001e\ufffd \ufffd\ufffd\ufffdI\u001eH\ufffd'\ufffdX\ufffd\ufffdg\b\ufffdT\ufffd\u0002R\ufffd\u00c4M\ufffd PYq\ufffd\ufffdV\ufffd\ufffdE\u0017\ufffd`\ufffd:\ufffd\ufffd\ufffd\ufffd#\ufffd\u00db\ufffd&\u0010\u0019\ufffd\u0005x\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffdkv\u0001e\ufffd \ufffd\ufffd\ufffdI\u001eH\ufffd'\ufffdX\ufffd\ufffdg\b\ufffdT\ufffd\u0002R\ufffd\u00c4M\ufffd PYq\ufffd\ufffdV\ufffd\ufffdE\u0017\ufffd`\ufffd:\ufffd\ufffd\ufffd\ufffd#\ufffd\u00db\ufffd&\u0010\u0019\ufffd\u0005x\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffdkv\u0001e\ufffd \ufffd\ufffd\ufffdI\u001eH\ufffd'\ufffdX\ufffd\ufffdg\b\ufffdT\ufffd\u0002R\ufffd\u00c4M\ufffd PYq\ufffd\ufffdV\ufffd\ufffdE\u0017\ufffd`\ufffd:\ufffd\ufffd\ufffd\ufffd#\ufffd\u00db\ufffd&\u0010\u0019\ufffd\u0005x\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffdkv\u0001e\ufffd \ufffd\ufffd\ufffdI\u001eH\ufffd'\ufffdX\ufffd\ufffdg\b\ufffdT\ufffd\u0002R\ufffd\u00c4M\ufffd PYq\ufffd\ufffdV\ufffd\ufffdE\u0017\ufffd`\ufffd:\ufffd\ufffd\ufffd\ufffd#\ufffd\u00db\ufffd&\u0010\u0019\ufffd\u0005x\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffdkv\u0001e\ufffd \ufffd\ufffd\ufffdI\u001eH\ufffd'\ufffdX\ufffd\ufffdg\b\ufffdT\ufffd\u0002R\ufffd\u00c4M\ufffd PYq\ufffd\ufffdV\ufffd\ufffdE\u0017\ufffd`\ufffd:\ufffd\ufffd\ufffd\ufffd#\ufffd\u00db\ufffd&\u0010\u0019\ufffd\u0005x\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1d578e5aef8f2b8a06596176ea28048abecbcba3",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�DI����o��PO���<@��l�-Xڍ�o i ֎�tiZ���Sn���
8'Y��zĶ;ak� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�DI����o��PO���<@��l�-Xڍ�o i ֎�tiZ���Sn��� 8'Y��zĶ;ak� >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"tls_ja3_hash": "c12b4ccd5320bbb380ca1a9df90f771d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 517,
"payload_entropy": 3.9142678042822956,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2bc30fe8a9509e231e6d686be81ea57ede3fec2b",
"event_fingerprint": "98d4495cbf8a645ec93d7a50a28f9b472a15d9dc",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"payload_hash": "1e26f470e9bf6810e52db10c48ec0320",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003DI\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffdP\u0003O\ufffd\u0004\u0012\ufffd\ufffd<@\ufffd\ufffdl\ufffd-X\u0012\u068d\u0013\ufffd\u0015o i\u0000\u058e\ufffdtiZ\ufffd\ufffd\ufffdSn\ufffd\u0007\ufffd\ufffd\n8'Y\ufffd\ufffdz\u0136;a\u0012k\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003DI\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffdP\u0003O\ufffd\u0004\u0012\ufffd\ufffd<@\ufffd\ufffdl\ufffd-X\u0012\u068d\u0013\ufffd\u0015o i\u0000\u058e\ufffdtiZ\ufffd\ufffd\ufffdSn\ufffd\u0007\ufffd\ufffd\n8'Y\ufffd\ufffdz\u0136;a\u0012k\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003DI\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffdP\u0003O\ufffd\u0004\u0012\ufffd\ufffd<@\ufffd\ufffdl\ufffd-X\u0012\u068d\u0013\ufffd\u0015o i\u0000\u058e\ufffdtiZ\ufffd\ufffd\ufffdSn\ufffd\u0007\ufffd\ufffd\n8'Y\ufffd\ufffdz\u0136;a\u0012k\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003DI\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffdP\u0003O\ufffd\u0004\u0012\ufffd\ufffd<@\ufffd\ufffdl\ufffd-X\u0012\u068d\u0013\ufffd\u0015o i\u0000\u058e\ufffdtiZ\ufffd\ufffd\ufffdSn\ufffd\u0007\ufffd\ufffd\n8'Y\ufffd\ufffdz\u0136;a\u0012k\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003DI\ufffd\ufffd\ufffd\ufffdo\ufffd\ufffdP\u0003O\ufffd\u0004\u0012\ufffd\ufffd<@\ufffd\ufffdl\ufffd-X\u0012\u068d\u0013\ufffd\u0015o i\u0000\u058e\ufffdtiZ\ufffd\ufffd\ufffdSn\ufffd\u0007\ufffd\ufffd\n8'Y\ufffd\ufffdz\u0136;a\u0012k\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "be1e3c90ce7b6e029c906e156d7745508852085a",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���V� ��0�$~��>�_ȯ�w��q��
b�7b �y�
�0����=A�z�O�:��e������=�9 � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ���V� ��0�$~��>�_ȯ�w��q�� b�7b �y� �0����=A�z�O�:��e������=�9 � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 426,
"payload_entropy": 5.997761990674484,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "a928118165cfec10cbaf082389fa88cf",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdV\ufffd\u001f\ufffd\ufffd0\ufffd$~\u0015\ufffd\ufffd>\ufffd_\u022f\ufffdw\ufffd\u0003\ufffdq\ufffd\ufffd\nb\ufffd7b \ufffdy\ufffd\r\ufffd0\ufffd\ufffd\ufffd\ufffd=A\ufffdz\u0014\ufffdO\ufffd:\ufffd\ufffde\ufffd\ufffd\ufffd\u001b\ufffd\ufffd\ufffd=\ufffd9\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdV\ufffd\u001f\ufffd\ufffd0\ufffd$~\u0015\ufffd\ufffd>\ufffd_\u022f\ufffdw\ufffd\u0003\ufffdq\ufffd\ufffd\nb\ufffd7b \ufffdy\ufffd\r\ufffd0\ufffd\ufffd\ufffd\ufffd=A\ufffdz\u0014\ufffdO\ufffd:\ufffd\ufffde\ufffd\ufffd\ufffd\u001b\ufffd\ufffd\ufffd=\ufffd9\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdV\ufffd\u001f\ufffd\ufffd0\ufffd$~\u0015\ufffd\ufffd>\ufffd_\u022f\ufffdw\ufffd\u0003\ufffdq\ufffd\ufffd\nb\ufffd7b \ufffdy\ufffd\r\ufffd0\ufffd\ufffd\ufffd\ufffd=A\ufffdz\u0014\ufffdO\ufffd:\ufffd\ufffde\ufffd\ufffd\ufffd\u001b\ufffd\ufffd\ufffd=\ufffd9\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdV\ufffd\u001f\ufffd\ufffd0\ufffd$~\u0015\ufffd\ufffd>\ufffd_\u022f\ufffdw\ufffd\u0003\ufffdq\ufffd\ufffd\nb\ufffd7b \ufffdy\ufffd\r\ufffd0\ufffd\ufffd\ufffd\ufffd=A\ufffdz\u0014\ufffdO\ufffd:\ufffd\ufffde\ufffd\ufffd\ufffd\u001b\ufffd\ufffd\ufffd=\ufffd9\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffdV\ufffd\u001f\ufffd\ufffd0\ufffd$~\u0015\ufffd\ufffd>\ufffd_\u022f\ufffdw\ufffd\u0003\ufffdq\ufffd\ufffd\nb\ufffd7b \ufffdy\ufffd\r\ufffd0\ufffd\ufffd\ufffd\ufffd=A\ufffdz\u0014\ufffdO\ufffd:\ufffd\ufffde\ufffd\ufffd\ufffd\u001b\ufffd\ufffd\ufffd=\ufffd9\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "98eca5c791c531490d3a41ab6b04e35f470687d7",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��X_0�]��b�i\-<suKҡt�y�C��.JE^ I,�~#f�G���|�g�#��� �Z[� % - � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� ��X_0�]��b�i\-<suKҡt�y�C��.JE^ I,�~#f�G���|�g�#��� �Z[� % - � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 6.01637483804988,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "bd579b52bc8c8bf8ccd88138adb9d3f3",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdX_0\ufffd\u001a]\ufffd\ufffdb\u000f\ufffdi\\-<suK\u04a1t\ufffdy\ufffdC\ufffd\ufffd.JE^ I,\ufffd~#f\ufffdG\ufffd\ufffd\ufffd\u0013|\ufffdg\ufffd#\ufffd\ufffd\u0017\ufffd \ufffd\u0017Z[\ufffd\u001f%\u001c-\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdX_0\ufffd\u001a]\ufffd\ufffdb\u000f\ufffdi\\-<suK\u04a1t\ufffdy\ufffdC\ufffd\ufffd.JE^ I,\ufffd~#f\ufffdG\ufffd\ufffd\ufffd\u0013|\ufffdg\ufffd#\ufffd\ufffd\u0017\ufffd \ufffd\u0017Z[\ufffd\u001f%\u001c-\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdX_0\ufffd\u001a]\ufffd\ufffdb\u000f\ufffdi\\-<suK\u04a1t\ufffdy\ufffdC\ufffd\ufffd.JE^ I,\ufffd~#f\ufffdG\ufffd\ufffd\ufffd\u0013|\ufffdg\ufffd#\ufffd\ufffd\u0017\ufffd \ufffd\u0017Z[\ufffd\u001f%\u001c-\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdX_0\ufffd\u001a]\ufffd\ufffdb\u000f\ufffdi\\-<suK\u04a1t\ufffdy\ufffdC\ufffd\ufffd.JE^ I,\ufffd~#f\ufffdG\ufffd\ufffd\ufffd\u0013|\ufffdg\ufffd#\ufffd\ufffd\u0017\ufffd \ufffd\u0017Z[\ufffd\u001f%\u001c-\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdX_0\ufffd\u001a]\ufffd\ufffdb\u000f\ufffdi\\-<suK\u04a1t\ufffdy\ufffdC\ufffd\ufffd.JE^ I,\ufffd~#f\ufffdG\ufffd\ufffd\ufffd\u0013|\ufffdg\ufffd#\ufffd\ufffd\u0017\ufffd \ufffd\u0017Z[\ufffd\u001f%\u001c-\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "45ddcfca5faad8bdcd0935a738f0f7e830cb3975",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���$�ˢ��a�
�~��U� ��-nv���
�^*S����5�9`�F�o��y�`!�>�^B � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ���$�ˢ��a� �~��U� ��-nv��� �^*SŃ����5�9`�F�o��y�`!�>�^B � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 416,
"payload_entropy": 5.978830165843074,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "b3f119a011800ec3d3fa0eb71691b5150ff0c999",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"payload_hash": "d73e3489a865f24f99e7209f9f50c1e2",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u000f\u0011\ufffd\u0011\ufffd$\ufffd\u02e2\ufffd\ufffda\ufffd\n\ufffd~\ufffd\ufffdU\u0007\ufffd\u001f\ufffd\ufffd-nv\ufffd\ufffd\u000f\ufffd\n \ufffd\u000f^*S\u0143\ufffd\ufffd\ufffd\ufffd5\ufffd9`\ufffdF\ufffdo\ufffd\u0016\ufffdy\ufffd`!\ufffd>\u0004\ufffd^B\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u000f\u0011\ufffd\u0011\ufffd$\ufffd\u02e2\ufffd\ufffda\ufffd\n\ufffd~\ufffd\ufffdU\u0007\ufffd\u001f\ufffd\ufffd-nv\ufffd\ufffd\u000f\ufffd\n \ufffd\u000f^*S\u0143\ufffd\ufffd\ufffd\ufffd5\ufffd9`\ufffdF\ufffdo\ufffd\u0016\ufffdy\ufffd`!\ufffd>\u0004\ufffd^B\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u000f\u0011\ufffd\u0011\ufffd$\ufffd\u02e2\ufffd\ufffda\ufffd\n\ufffd~\ufffd\ufffdU\u0007\ufffd\u001f\ufffd\ufffd-nv\ufffd\ufffd\u000f\ufffd\n \ufffd\u000f^*S\u0143\ufffd\ufffd\ufffd\ufffd5\ufffd9`\ufffdF\ufffdo\ufffd\u0016\ufffdy\ufffd`!\ufffd>\u0004\ufffd^B\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u000f\u0011\ufffd\u0011\ufffd$\ufffd\u02e2\ufffd\ufffda\ufffd\n\ufffd~\ufffd\ufffdU\u0007\ufffd\u001f\ufffd\ufffd-nv\ufffd\ufffd\u000f\ufffd\n \ufffd\u000f^*S\u0143\ufffd\ufffd\ufffd\ufffd5\ufffd9`\ufffdF\ufffdo\ufffd\u0016\ufffdy\ufffd`!\ufffd>\u0004\ufffd^B\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u000f\u0011\ufffd\u0011\ufffd$\ufffd\u02e2\ufffd\ufffda\ufffd\n\ufffd~\ufffd\ufffdU\u0007\ufffd\u001f\ufffd\ufffd-nv\ufffd\ufffd\u000f\ufffd\n \ufffd\u000f^*S\u0143\ufffd\ufffd\ufffd\ufffd5\ufffd9`\ufffdF\ufffdo\ufffd\u0016\ufffdy\ufffd`!\ufffd>\u0004\ufffd^B\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "206b855d7f6c3fe5764027e6e725744cd9683bf1",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �#E2�s����t��ľQ㘡"ז5�Vl�J ء,\��¯R�:a7<���P.đr���c��+��� �::����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� �#E2�s����t��ľQ㘡"ז5�Vl�J ء,\��¯R�:a7<���P.đr���c��+��� �::����'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ٺ� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "b529046670b0034559687a6e4bed5da8",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 439,
"payload_entropy": 5.981592224037759,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "c12940ed13ae91529686e7afb7280f66d0e3ad0f",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "b529046670b0034559687a6e4bed5da8",
"payload_hash": "9b9d1d6039daf0c5daf6b19246c04247",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003#E2\ufffds\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u013eQ\u3621\"\u05d65\u074c\u0016\ufffdVl\ufffdJ \u0621,\\\ufffd\ufffd\u00afR\ufffd:a7<\ufffd\ufffd\ufffdP.\u0111r\ufffd\ufffd\ufffdc\ufffd\ufffd+\ufffd\ufffd\ufffd\u0000\ufffd::\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003#E2\ufffds\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u013eQ\u3621\"\u05d65\u074c\u0016\ufffdVl\ufffdJ \u0621,\\\ufffd\ufffd\u00afR\ufffd:a7<\ufffd\ufffd\ufffdP.\u0111r\ufffd\ufffd\ufffdc\ufffd\ufffd+\ufffd\ufffd\ufffd\u0000\ufffd::\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\u067a\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003#E2\ufffds\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u013eQ\u3621\"\u05d65\u074c\u0016\ufffdVl\ufffdJ \u0621,\\\ufffd\ufffd\u00afR\ufffd:a7<\ufffd\ufffd\ufffdP.\u0111r\ufffd\ufffd\ufffdc\ufffd\ufffd+\ufffd\ufffd\ufffd\u0000\ufffd::\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003#E2\ufffds\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u013eQ\u3621\"\u05d65\u074c\u0016\ufffdVl\ufffdJ \u0621,\\\ufffd\ufffd\u00afR\ufffd:a7<\ufffd\ufffd\ufffdP.\u0111r\ufffd\ufffd\ufffdc\ufffd\ufffd+\ufffd\ufffd\ufffd\u0000\ufffd::\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\u067a\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003#E2\ufffds\ufffd\ufffd\ufffd\ufffdt\ufffd\ufffd\u013eQ\u3621\"\u05d65\u074c\u0016\ufffdVl\ufffdJ \u0621,\\\ufffd\ufffd\u00afR\ufffd:a7<\ufffd\ufffd\ufffdP.\u0111r\ufffd\ufffd\ufffdc\ufffd\ufffd+\ufffd\ufffd\ufffd\u0000\ufffd::\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "03b34cf96036d680eca1cccf5401c4282f2893db",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T PM����}ڙ�x$W�~>Z �j��SW�+�4� �UW:Q ����)_���pT�H�q=����Rњ F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T PM����}ڙ�x$W�~>Z �j��SW�+�4� �UW:Q ����)_���pT�H�q=����Rњ F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 345,
"payload_entropy": 6.060604404593308,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "dba5f6074e75af26ae4ac6bcdf06131c655bc11d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "03a3ad27040f733ee5c9915e0903d028",
"payload_hash": "7b0fa44ce1ea08a464f746a91831ebe3",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003M\ufffd\ufffd\ufffd\u0015\ufffd\u0001}\u0699\ufffdx$W\ufffd\u0005~>Z\u0000\ufffdj\ufffd\ufffdSW\ufffd+\ufffd\u00144\ufffd \u001c\ufffdUW:Q\u001c\ufffd\ufffd\ufffd\u0010\ufffd)_\ufffd\ufffd\ufffdpT\ufffdH\ufffdq=\ufffd\ufffd\ufffd\ufffdR\u0014\u045a\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003M\ufffd\ufffd\ufffd\u0015\ufffd\u0001}\u0699\ufffdx$W\ufffd\u0005~>Z\u0000\ufffdj\ufffd\ufffdSW\ufffd+\ufffd\u00144\ufffd \u001c\ufffdUW:Q\u001c\ufffd\ufffd\ufffd\u0010\ufffd)_\ufffd\ufffd\ufffdpT\ufffdH\ufffdq=\ufffd\ufffd\ufffd\ufffdR\u0014\u045a\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003M\ufffd\ufffd\ufffd\u0015\ufffd\u0001}\u0699\ufffdx$W\ufffd\u0005~>Z\u0000\ufffdj\ufffd\ufffdSW\ufffd+\ufffd\u00144\ufffd \u001c\ufffdUW:Q\u001c\ufffd\ufffd\ufffd\u0010\ufffd)_\ufffd\ufffd\ufffdpT\ufffdH\ufffdq=\ufffd\ufffd\ufffd\ufffdR\u0014\u045a\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003M\ufffd\ufffd\ufffd\u0015\ufffd\u0001}\u0699\ufffdx$W\ufffd\u0005~>Z\u0000\ufffdj\ufffd\ufffdSW\ufffd+\ufffd\u00144\ufffd \u001c\ufffdUW:Q\u001c\ufffd\ufffd\ufffd\u0010\ufffd)_\ufffd\ufffd\ufffdpT\ufffdH\ufffdq=\ufffd\ufffd\ufffd\ufffdR\u0014\u045a\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003M\ufffd\ufffd\ufffd\u0015\ufffd\u0001}\u0699\ufffdx$W\ufffd\u0005~>Z\u0000\ufffdj\ufffd\ufffdSW\ufffd+\ufffd\u00144\ufffd \u001c\ufffdUW:Q\u001c\ufffd\ufffd\ufffd\u0010\ufffd)_\ufffd\ufffd\ufffdpT\ufffdH\ufffdq=\ufffd\ufffd\ufffd\ufffdR\u0014\u045a\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c6ee8f2508c042529c29eeb4e549793518cbe957",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F B��Tc�G)J�Ǒ;[ɾ���ަ�}�5�{�� �3���/6���@�PLAM�ߒ �7�A*wR D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F B��Tc�G)J�Ǒ;[ɾ���ަ�}�5�{�� �3���/6���@�PLAM�ߒ �7�A*wR D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"tls_ja3_hash": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 11,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2c",
"hq"
],
"bytes_in": 331,
"payload_entropy": 6.061163148523081,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "5ea4964083662cfc7b514c9c02916c805265a734",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a96dc3876784813c57d302241e620acd",
"payload_hash": "493b662f6d215532c9bc3f6332f73e82",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffdTc\u001b\u0010\ufffdG)J\ufffd\u01d1;[\u027e\ufffd\ufffd\ufffd\u07a6\ufffd}\ufffd5\ufffd\u0011{\ufffd\ufffd \ufffd3\ufffd\ufffd\ufffd\/\u00166\ufffd\ufffd\u0018\u000f\ufffd@\ufffdPLAM\ufffd\u07d2\u001d\ufffd7\ufffdA\u0097*wR\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffdTc\u001b\u0010\ufffdG)J\ufffd\u01d1;[\u027e\ufffd\ufffd\ufffd\u07a6\ufffd}\ufffd5\ufffd\u0011{\ufffd\ufffd \ufffd3\ufffd\ufffd\ufffd\/\u00166\ufffd\ufffd\u0018\u000f\ufffd@\ufffdPLAM\ufffd\u07d2\u001d\ufffd7\ufffdA\u0097*wR\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffdTc\u001b\u0010\ufffdG)J\ufffd\u01d1;[\u027e\ufffd\ufffd\ufffd\u07a6\ufffd}\ufffd5\ufffd\u0011{\ufffd\ufffd \ufffd3\ufffd\ufffd\ufffd\/\u00166\ufffd\ufffd\u0018\u000f\ufffd@\ufffdPLAM\ufffd\u07d2\u001d\ufffd7\ufffdA\u0097*wR\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffdTc\u001b\u0010\ufffdG)J\ufffd\u01d1;[\u027e\ufffd\ufffd\ufffd\u07a6\ufffd}\ufffd5\ufffd\u0011{\ufffd\ufffd \ufffd3\ufffd\ufffd\ufffd\/\u00166\ufffd\ufffd\u0018\u000f\ufffd@\ufffdPLAM\ufffd\u07d2\u001d\ufffd7\ufffdA\u0097*wR\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\ufffdTc\u001b\u0010\ufffdG)J\ufffd\u01d1;[\u027e\ufffd\ufffd\ufffd\u07a6\ufffd}\ufffd5\ufffd\u0011{\ufffd\ufffd \ufffd3\ufffd\ufffd\ufffd\/\u00166\ufffd\ufffd\u0018\u000f\ufffd@\ufffdPLAM\ufffd\u07d2\u001d\ufffd7\ufffdA\u0097*wR\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "64a7cb7b4cdaa4e02cb4a72045e6cfb68be8753f",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��#B@�� |||�渝Nč��a!�s�*��t� �<x�41'5c ��j��quzb]~�|�7�&H~� �**����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ��#B@�� |||�渝Nč��a!�s�*��t� �<x�41'5c ��j��quzb]~�|�7�&H~� �**����'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ��� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "6941b4e1cdec8ca1dc37870a1103941f",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 412,
"payload_entropy": 6.0016296361604455,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "28ca2f86d1e5fa435488a89c7f598637307e3e51",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "6941b4e1cdec8ca1dc37870a1103941f",
"payload_hash": "d7ec8e2e92f20d52156ba7fadd3c0ca8",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd#\u0012B@\ufffd\ufffd\u001c|||\ufffd\u6e1dN\u010d\u000f\ufffd\ufffd\u0006a!\ufffds\ufffd*\ufffd\ufffdt\ufffd \ufffd<x\ufffd41'5c \ufffd\ufffdj\ufffd\ufffdquzb]~\ufffd|\ufffd7\u0002\ufffd\u000e&H~\ufffd\u0000\ufffd**\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd#\u0012B@\ufffd\ufffd\u001c|||\ufffd\u6e1dN\u010d\u000f\ufffd\ufffd\u0006a!\ufffds\ufffd*\ufffd\ufffdt\ufffd \ufffd<x\ufffd41'5c \ufffd\ufffdj\ufffd\ufffdquzb]~\ufffd|\ufffd7\u0002\ufffd\u000e&H~\ufffd\u0000\ufffd**\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd#\u0012B@\ufffd\ufffd\u001c|||\ufffd\u6e1dN\u010d\u000f\ufffd\ufffd\u0006a!\ufffds\ufffd*\ufffd\ufffdt\ufffd \ufffd<x\ufffd41'5c \ufffd\ufffdj\ufffd\ufffdquzb]~\ufffd|\ufffd7\u0002\ufffd\u000e&H~\ufffd\u0000\ufffd**\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd#\u0012B@\ufffd\ufffd\u001c|||\ufffd\u6e1dN\u010d\u000f\ufffd\ufffd\u0006a!\ufffds\ufffd*\ufffd\ufffdt\ufffd \ufffd<x\ufffd41'5c \ufffd\ufffdj\ufffd\ufffdquzb]~\ufffd|\ufffd7\u0002\ufffd\u000e&H~\ufffd\u0000\ufffd**\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd#\u0012B@\ufffd\ufffd\u001c|||\ufffd\u6e1dN\u010d\u000f\ufffd\ufffd\u0006a!\ufffds\ufffd*\ufffd\ufffdt\ufffd \ufffd<x\ufffd41'5c \ufffd\ufffdj\ufffd\ufffdquzb]~\ufffd|\ufffd7\u0002\ufffd\u000e&H~\ufffd\u0000\ufffd**\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "71d7d4b120b9a4c41edd58ee0b1d60b518f29250",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��8A��H��d���/''�2Ds�J�|\b � 4{�� ��;�~����$J����2��� �a � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��8A��H��d���/''�2Ds�J�|\b � 4{�� ��;�~����$J����2��� �a � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 413,
"payload_entropy": 5.994492575604906,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "bfe7ebd9eacb175e5a75eef65d0215e1d2e6cdfe",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "006315b3ad276906ff11527f9594e5ba",
"payload_hash": "dc03b97a59f2590424dbeb584f992f67",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd8A\ufffd\ufffdH\ufffd\ufffdd\u0018\u001b\ufffd\ufffd\ufffd\/''\ufffd2\u001aDs\ufffdJ\ufffd|\\b\u001d\ufffd \u00154{\ufffd\ufffd\u0000\ufffd\ufffd;\ufffd\u0015~\ufffd\ufffd\ufffd\ufffd\u0004$J\ufffd\u001b\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd\u000b\u0012\ufffda\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd8A\ufffd\ufffdH\ufffd\ufffdd\u0018\u001b\ufffd\ufffd\ufffd\/''\ufffd2\u001aDs\ufffdJ\ufffd|\\b\u001d\ufffd \u00154{\ufffd\ufffd\u0000\ufffd\ufffd;\ufffd\u0015~\ufffd\ufffd\ufffd\ufffd\u0004$J\ufffd\u001b\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd\u000b\u0012\ufffda\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd8A\ufffd\ufffdH\ufffd\ufffdd\u0018\u001b\ufffd\ufffd\ufffd\/''\ufffd2\u001aDs\ufffdJ\ufffd|\\b\u001d\ufffd \u00154{\ufffd\ufffd\u0000\ufffd\ufffd;\ufffd\u0015~\ufffd\ufffd\ufffd\ufffd\u0004$J\ufffd\u001b\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd\u000b\u0012\ufffda\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd8A\ufffd\ufffdH\ufffd\ufffdd\u0018\u001b\ufffd\ufffd\ufffd\/''\ufffd2\u001aDs\ufffdJ\ufffd|\\b\u001d\ufffd \u00154{\ufffd\ufffd\u0000\ufffd\ufffd;\ufffd\u0015~\ufffd\ufffd\ufffd\ufffd\u0004$J\ufffd\u001b\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd\u000b\u0012\ufffda\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd8A\ufffd\ufffdH\ufffd\ufffdd\u0018\u001b\ufffd\ufffd\ufffd\/''\ufffd2\u001aDs\ufffdJ\ufffd|\\b\u001d\ufffd \u00154{\ufffd\ufffd\u0000\ufffd\ufffd;\ufffd\u0015~\ufffd\ufffd\ufffd\ufffd\u0004$J\ufffd\u001b\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffd\u000b\u0012\ufffda\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "83edd2bbefdfebc3ac199c0ff285e89767aadfe6",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��ɐvd��o9���W�n���Lb)�S��G]9�� �tW�)B�J#�zh
��>��O�'�Q�� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��ɐvd��o9���W�n���Lb)�S��G]9�� �tW�)B�J#�zh ��>��O�'�Q�� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 424,
"payload_entropy": 6.050622972597928,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "bdefcb544f5915b1b0c2ac28dc497b21",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0250vd\ufffd\ufffdo9\ufffd\ufffd\ufffdW\ufffdn\u000e\ufffd\ufffd\ufffdLb)\ufffdS\ufffd\ufffdG]\u00159\ufffd\ufffd \ufffdtW\ufffd)B\u0006\u001b\u001a\ufffdJ#\ufffdzh\r\ufffd\ufffd>\ufffd\ufffdO\ufffd'\ufffdQ\ufffd\u001a\ufffd\u0017\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0250vd\ufffd\ufffdo9\ufffd\ufffd\ufffdW\ufffdn\u000e\ufffd\ufffd\ufffdLb)\ufffdS\ufffd\ufffdG]\u00159\ufffd\ufffd \ufffdtW\ufffd)B\u0006\u001b\u001a\ufffdJ#\ufffdzh\r\ufffd\ufffd>\ufffd\ufffdO\ufffd'\ufffdQ\ufffd\u001a\ufffd\u0017\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0250vd\ufffd\ufffdo9\ufffd\ufffd\ufffdW\ufffdn\u000e\ufffd\ufffd\ufffdLb)\ufffdS\ufffd\ufffdG]\u00159\ufffd\ufffd \ufffdtW\ufffd)B\u0006\u001b\u001a\ufffdJ#\ufffdzh\r\ufffd\ufffd>\ufffd\ufffdO\ufffd'\ufffdQ\ufffd\u001a\ufffd\u0017\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0250vd\ufffd\ufffdo9\ufffd\ufffd\ufffdW\ufffdn\u000e\ufffd\ufffd\ufffdLb)\ufffdS\ufffd\ufffdG]\u00159\ufffd\ufffd \ufffdtW\ufffd)B\u0006\u001b\u001a\ufffdJ#\ufffdzh\r\ufffd\ufffd>\ufffd\ufffdO\ufffd'\ufffdQ\ufffd\u001a\ufffd\u0017\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0250vd\ufffd\ufffdo9\ufffd\ufffd\ufffdW\ufffdn\u000e\ufffd\ufffd\ufffdLb)\ufffdS\ufffd\ufffdG]\u00159\ufffd\ufffd \ufffdtW\ufffd)B\u0006\u001b\u001a\ufffdJ#\ufffdzh\r\ufffd\ufffd>\ufffd\ufffdO\ufffd'\ufffdQ\ufffd\u001a\ufffd\u0017\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e8c780938bf9e10837d205696156650875c4f341",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �i�}w���ݶ�Ax⾒]�d�DX�?� {ow�
ʨ��C��;�IZ�m�d�2����z�a � q � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �i�}w���ݶ�Ax⾒]�d�DX�?� {ow� ʨ��C��;�IZ�m�d�2����z�a � q � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 5.971020618281928,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "eee991d07722758345dd5360b6a89d1d",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003i\ufffd}\u0017w\ufffd\ufffd\ufffd\u0776\ufffdAx\u2f92]\ufffdd\ufffdDX\ufffd?\ufffd\b\u000b{ow\ufffd\n \u02a8\ufffd\ufffdC\ufffd\ufffd;\u0017\ufffdIZ\ufffdm\ufffdd\ufffd\u000f2\ufffd\ufffd\ufffd\u000f\ufffdz\ufffda\u001e\ufffd\u001fq\u0004\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003i\ufffd}\u0017w\ufffd\ufffd\ufffd\u0776\ufffdAx\u2f92]\ufffdd\ufffdDX\ufffd?\ufffd\b\u000b{ow\ufffd\n \u02a8\ufffd\ufffdC\ufffd\ufffd;\u0017\ufffdIZ\ufffdm\ufffdd\ufffd\u000f2\ufffd\ufffd\ufffd\u000f\ufffdz\ufffda\u001e\ufffd\u001fq\u0004\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003i\ufffd}\u0017w\ufffd\ufffd\ufffd\u0776\ufffdAx\u2f92]\ufffdd\ufffdDX\ufffd?\ufffd\b\u000b{ow\ufffd\n \u02a8\ufffd\ufffdC\ufffd\ufffd;\u0017\ufffdIZ\ufffdm\ufffdd\ufffd\u000f2\ufffd\ufffd\ufffd\u000f\ufffdz\ufffda\u001e\ufffd\u001fq\u0004\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003i\ufffd}\u0017w\ufffd\ufffd\ufffd\u0776\ufffdAx\u2f92]\ufffdd\ufffdDX\ufffd?\ufffd\b\u000b{ow\ufffd\n \u02a8\ufffd\ufffdC\ufffd\ufffd;\u0017\ufffdIZ\ufffdm\ufffdd\ufffd\u000f2\ufffd\ufffd\ufffd\u000f\ufffdz\ufffda\u001e\ufffd\u001fq\u0004\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003i\ufffd}\u0017w\ufffd\ufffd\ufffd\u0776\ufffdAx\u2f92]\ufffdd\ufffdDX\ufffd?\ufffd\b\u000b{ow\ufffd\n \u02a8\ufffd\ufffdC\ufffd\ufffd;\u0017\ufffdIZ\ufffdm\ufffdd\ufffd\u000f2\ufffd\ufffd\ufffd\u000f\ufffdz\ufffda\u001e\ufffd\u001fq\u0004\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f6585594f75241bdde8d952b810dc38a731e50b5",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�)Z�E݀�~��y�V6������D"�(�ZۚcW ��2�Z����W����C%C�{��կ��q&?S o >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�)Z�E݀�~��y�V6������D"�(�ZۚcW ��2�Z����W����C%C�{��կ��q&?S o >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"tls_ja3_hash": "c12b4ccd5320bbb380ca1a9df90f771d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 517,
"payload_entropy": 3.999307449297166,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2bc30fe8a9509e231e6d686be81ea57ede3fec2b",
"event_fingerprint": "98d4495cbf8a645ec93d7a50a28f9b472a15d9dc",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"payload_hash": "29cc2ab3f70ff7647ebaa0d1c5c77933",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003)Z\ufffdE\u0740\ufffd~\ufffd\ufffdy\ufffdV\u00186\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdD\"\ufffd(\ufffdZ\u06dacW \ufffd\ufffd2\ufffdZ\ufffd\ufffd\ufffd\ufffdW\b\ufffd\ufffd\ufffd\ufffdC%C\ufffd{\ufffd\ufffd\u056f\ufffd\ufffdq&?S\u001eo\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003)Z\ufffdE\u0740\ufffd~\ufffd\ufffdy\ufffdV\u00186\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdD\"\ufffd(\ufffdZ\u06dacW \ufffd\ufffd2\ufffdZ\ufffd\ufffd\ufffd\ufffdW\b\ufffd\ufffd\ufffd\ufffdC%C\ufffd{\ufffd\ufffd\u056f\ufffd\ufffdq&?S\u001eo\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003)Z\ufffdE\u0740\ufffd~\ufffd\ufffdy\ufffdV\u00186\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdD\"\ufffd(\ufffdZ\u06dacW \ufffd\ufffd2\ufffdZ\ufffd\ufffd\ufffd\ufffdW\b\ufffd\ufffd\ufffd\ufffdC%C\ufffd{\ufffd\ufffd\u056f\ufffd\ufffdq&?S\u001eo\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003)Z\ufffdE\u0740\ufffd~\ufffd\ufffdy\ufffdV\u00186\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdD\"\ufffd(\ufffdZ\u06dacW \ufffd\ufffd2\ufffdZ\ufffd\ufffd\ufffd\ufffdW\b\ufffd\ufffd\ufffd\ufffdC%C\ufffd{\ufffd\ufffd\u056f\ufffd\ufffdq&?S\u001eo\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003)Z\ufffdE\u0740\ufffd~\ufffd\ufffdy\ufffdV\u00186\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdD\"\ufffd(\ufffdZ\u06dacW \ufffd\ufffd2\ufffdZ\ufffd\ufffd\ufffd\ufffdW\b\ufffd\ufffd\ufffd\ufffdC%C\ufffd{\ufffd\ufffd\u056f\ufffd\ufffdq&?S\u001eo\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b786dcacb9759644884a10ccf37397be9f2816dc",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �I'���J �Z���H]�A�3D�%�70�E� ]r�w�>��Y�zr����~��h0@��@��̋ � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �I'���J �Z���H]�A�3D�%�70�E� ]r�w�>��Y�zr����~��h0@��@��̋ � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 5.9313415477406295,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "deb69743ca549c537a4a698e59e8097a",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003I'\ufffd\ufffd\ufffdJ\u001d\ufffdZ\u0019\ufffd\ufffd\ufffdH]\ufffdA\ufffd3D\ufffd%\u000f\u0017\u0001\ufffd70\ufffdE\ufffd ]r\u0006\ufffdw\ufffd>\u0015\ufffd\ufffdY\ufffdzr\ufffd\ufffd\u000f\ufffd\ufffd~\ufffd\ufffdh0@\ufffd\ufffd@\ufffd\ufffd\u030b\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003I'\ufffd\ufffd\ufffdJ\u001d\ufffdZ\u0019\ufffd\ufffd\ufffdH]\ufffdA\ufffd3D\ufffd%\u000f\u0017\u0001\ufffd70\ufffdE\ufffd ]r\u0006\ufffdw\ufffd>\u0015\ufffd\ufffdY\ufffdzr\ufffd\ufffd\u000f\ufffd\ufffd~\ufffd\ufffdh0@\ufffd\ufffd@\ufffd\ufffd\u030b\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003I'\ufffd\ufffd\ufffdJ\u001d\ufffdZ\u0019\ufffd\ufffd\ufffdH]\ufffdA\ufffd3D\ufffd%\u000f\u0017\u0001\ufffd70\ufffdE\ufffd ]r\u0006\ufffdw\ufffd>\u0015\ufffd\ufffdY\ufffdzr\ufffd\ufffd\u000f\ufffd\ufffd~\ufffd\ufffdh0@\ufffd\ufffd@\ufffd\ufffd\u030b\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003I'\ufffd\ufffd\ufffdJ\u001d\ufffdZ\u0019\ufffd\ufffd\ufffdH]\ufffdA\ufffd3D\ufffd%\u000f\u0017\u0001\ufffd70\ufffdE\ufffd ]r\u0006\ufffdw\ufffd>\u0015\ufffd\ufffdY\ufffdzr\ufffd\ufffd\u000f\ufffd\ufffd~\ufffd\ufffdh0@\ufffd\ufffd@\ufffd\ufffd\u030b\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003I'\ufffd\ufffd\ufffdJ\u001d\ufffdZ\u0019\ufffd\ufffd\ufffdH]\ufffdA\ufffd3D\ufffd%\u000f\u0017\u0001\ufffd70\ufffdE\ufffd ]r\u0006\ufffdw\ufffd>\u0015\ufffd\ufffdY\ufffdzr\ufffd\ufffd\u000f\ufffd\ufffd~\ufffd\ufffdh0@\ufffd\ufffd@\ufffd\ufffd\u030b\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4c3408b73fd10936c1add7576a668435bf0e08f2",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �[ZW�����`L�l�v�`_}r�����U��~� k̩�`)�Daé����4W��i$�uz {М � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �[ZW�����`L�l�v�`_}r�����U��~� k̩�`)�Daé����4W��i$�uz {М � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 416,
"payload_entropy": 6.009351504093415,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "b3f119a011800ec3d3fa0eb71691b5150ff0c999",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"payload_hash": "4c12fa3a5fb2a66754a774b8d47dfee9",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003[ZW\u0012\ufffd\ufffd\ufffd\ufffd\ufffd`L\ufffdl\ufffdv\ufffd`\u0007_}r\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd~\u0006\ufffd k\u0329\ufffd`)\ufffdDa\u00e9\ufffd\u0014\ufffd\ufffd\ufffd4W\ufffd\ufffd\u000ei$\ufffd\u0018uz\u0000{\u041c\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003[ZW\u0012\ufffd\ufffd\ufffd\ufffd\ufffd`L\ufffdl\ufffdv\ufffd`\u0007_}r\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd~\u0006\ufffd k\u0329\ufffd`)\ufffdDa\u00e9\ufffd\u0014\ufffd\ufffd\ufffd4W\ufffd\ufffd\u000ei$\ufffd\u0018uz\u0000{\u041c\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003[ZW\u0012\ufffd\ufffd\ufffd\ufffd\ufffd`L\ufffdl\ufffdv\ufffd`\u0007_}r\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd~\u0006\ufffd k\u0329\ufffd`)\ufffdDa\u00e9\ufffd\u0014\ufffd\ufffd\ufffd4W\ufffd\ufffd\u000ei$\ufffd\u0018uz\u0000{\u041c\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003[ZW\u0012\ufffd\ufffd\ufffd\ufffd\ufffd`L\ufffdl\ufffdv\ufffd`\u0007_}r\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd~\u0006\ufffd k\u0329\ufffd`)\ufffdDa\u00e9\ufffd\u0014\ufffd\ufffd\ufffd4W\ufffd\ufffd\u000ei$\ufffd\u0018uz\u0000{\u041c\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003[ZW\u0012\ufffd\ufffd\ufffd\ufffd\ufffd`L\ufffdl\ufffdv\ufffd`\u0007_}r\ufffd\ufffd\ufffd\ufffd\ufffdU\ufffd\ufffd~\u0006\ufffd k\u0329\ufffd`)\ufffdDa\u00e9\ufffd\u0014\ufffd\ufffd\ufffd4W\ufffd\ufffd\u000ei$\ufffd\u0018uz\u0000{\u041c\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b78e1d21790531ccf2b6645b88abf9b2084b9db",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��b��`T�� ֑�E�������h�� P m��?m�� ֵؑ �e�#�� [��Zu��� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ��b��`T�� ֑�E�������h�� P m��?m�� ֵؑ �e�#�� [��Zu��� �������'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "c09985de3e96d595b628e54111f739c7",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 439,
"payload_entropy": 6.0267123541001615,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "d66d83f9f7bf87f5d5990545958b7e95d4aab2ee",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c09985de3e96d595b628e54111f739c7",
"payload_hash": "251ef894dede92408026fbed0c9b927d",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdb\ufffd\ufffd`T\u001a\u0015\u000e\ufffd\ufffd\u001d\u0591\ufffdE\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd\f\u000eP m\ufffd\u0017\ufffd?m\ufffd\ufffd\u000b\u0611\u001b\u05b5 \ufffde\ufffd#\ufffd\ufffd\f\u0013[\ufffd\ufffdZu\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdb\ufffd\ufffd`T\u001a\u0015\u000e\ufffd\ufffd\u001d\u0591\ufffdE\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd\f\u000eP m\ufffd\u0017\ufffd?m\ufffd\ufffd\u000b\u0611\u001b\u05b5 \ufffde\ufffd#\ufffd\ufffd\f\u0013[\ufffd\ufffdZu\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\n\n\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdb\ufffd\ufffd`T\u001a\u0015\u000e\ufffd\ufffd\u001d\u0591\ufffdE\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd\f\u000eP m\ufffd\u0017\ufffd?m\ufffd\ufffd\u000b\u0611\u001b\u05b5 \ufffde\ufffd#\ufffd\ufffd\f\u0013[\ufffd\ufffdZu\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdb\ufffd\ufffd`T\u001a\u0015\u000e\ufffd\ufffd\u001d\u0591\ufffdE\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd\f\u000eP m\ufffd\u0017\ufffd?m\ufffd\ufffd\u000b\u0611\u001b\u05b5 \ufffde\ufffd#\ufffd\ufffd\f\u0013[\ufffd\ufffdZu\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\n\n\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdb\ufffd\ufffd`T\u001a\u0015\u000e\ufffd\ufffd\u001d\u0591\ufffdE\ufffd\ufffd\u0011\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd\f\u000eP m\ufffd\u0017\ufffd?m\ufffd\ufffd\u000b\u0611\u001b\u05b5 \ufffde\ufffd#\ufffd\ufffd\f\u0013[\ufffd\ufffdZu\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "711e2b9f99602f56aadbc6e82e7339eb609380b8",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T Pc��IJdg6�,�x�nK3���7�Q��� X3=�8�Ha��5�OD �v���$֍��<� F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T Pc��IJdg6�,�x�nK3���7�Q��� X3=�8�Ha��5�OD �v���$֍��<� F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 345,
"payload_entropy": 6.10729384457779,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "dba5f6074e75af26ae4ac6bcdf06131c655bc11d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "03a3ad27040f733ee5c9915e0903d028",
"payload_hash": "c22d39de6150273adbe9b1b2fe5489d6",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003c\ufffd\ufffd\u0132dg6\ufffd,\ufffdx\ud89d\ude76\ufffdnK3\ufffd\ufffd\ufffd7\ufffdQ\ufffd\ufffd\ufffd\u001a X3=\ufffd8\ufffd\u0016Ha\ufffd\u0016\ufffd5\ufffdOD\u001c\u0001\ufffdv\ufffd\ufffd\ufffd$\u058d\u0011\u001a\ufffd\ufffd<\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003c\ufffd\ufffd\u0132dg6\ufffd,\ufffdx\ud89d\ude76\ufffdnK3\ufffd\ufffd\ufffd7\ufffdQ\ufffd\ufffd\ufffd\u001a X3=\ufffd8\ufffd\u0016Ha\ufffd\u0016\ufffd5\ufffdOD\u001c\u0001\ufffdv\ufffd\ufffd\ufffd$\u058d\u0011\u001a\ufffd\ufffd<\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003c\ufffd\ufffd\u0132dg6\ufffd,\ufffdx\ud89d\ude76\ufffdnK3\ufffd\ufffd\ufffd7\ufffdQ\ufffd\ufffd\ufffd\u001a X3=\ufffd8\ufffd\u0016Ha\ufffd\u0016\ufffd5\ufffdOD\u001c\u0001\ufffdv\ufffd\ufffd\ufffd$\u058d\u0011\u001a\ufffd\ufffd<\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003c\ufffd\ufffd\u0132dg6\ufffd,\ufffdx\ud89d\ude76\ufffdnK3\ufffd\ufffd\ufffd7\ufffdQ\ufffd\ufffd\ufffd\u001a X3=\ufffd8\ufffd\u0016Ha\ufffd\u0016\ufffd5\ufffdOD\u001c\u0001\ufffdv\ufffd\ufffd\ufffd$\u058d\u0011\u001a\ufffd\ufffd<\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003c\ufffd\ufffd\u0132dg6\ufffd,\ufffdx\ud89d\ude76\ufffdnK3\ufffd\ufffd\ufffd7\ufffdQ\ufffd\ufffd\ufffd\u001a X3=\ufffd8\ufffd\u0016Ha\ufffd\u0016\ufffd5\ufffdOD\u001c\u0001\ufffdv\ufffd\ufffd\ufffd$\u058d\u0011\u001a\ufffd\ufffd<\ufffd\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2d8018658cdd2a602004a2551b4fd15e0374d86",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F B� JlG_�ҽ~b�ӷ?Q�'nV��J��+ F* �S>Z�iڄ��Q<X���*5F4Q�c0� D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F B� JlG_�ҽ~b�ӷ?Q�'nV��J��+ F* �S>Z�iڄ��Q<X���*5F4Q�c0� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"tls_ja3_hash": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 11,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2c",
"hq"
],
"bytes_in": 331,
"payload_entropy": 5.971835503411106,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "5ea4964083662cfc7b514c9c02916c805265a734",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a96dc3876784813c57d302241e620acd",
"payload_hash": "b53db34ad7fb439eeabcfaa482ade2ea",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\u0005\u001fJlG_\u0016\ufffd\u04bd~b\ufffd\u0010\u04f7?\u0013Q\ufffd'nV\ufffd\b\ufffd\u0017J\ufffd\ufffd+ F* \ufffdS>Z\ufffd\u0002i\u000e\u0684\ufffd\ufffdQ<X\ufffd\ufffd\u0017\ufffd*5F4\u0013Q\ufffdc0\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\u0005\u001fJlG_\u0016\ufffd\u04bd~b\ufffd\u0010\u04f7?\u0013Q\ufffd'nV\ufffd\b\ufffd\u0017J\ufffd\ufffd+ F* \ufffdS>Z\ufffd\u0002i\u000e\u0684\ufffd\ufffdQ<X\ufffd\ufffd\u0017\ufffd*5F4\u0013Q\ufffdc0\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\u0005\u001fJlG_\u0016\ufffd\u04bd~b\ufffd\u0010\u04f7?\u0013Q\ufffd'nV\ufffd\b\ufffd\u0017J\ufffd\ufffd+ F* \ufffdS>Z\ufffd\u0002i\u000e\u0684\ufffd\ufffdQ<X\ufffd\ufffd\u0017\ufffd*5F4\u0013Q\ufffdc0\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\u0005\u001fJlG_\u0016\ufffd\u04bd~b\ufffd\u0010\u04f7?\u0013Q\ufffd'nV\ufffd\b\ufffd\u0017J\ufffd\ufffd+ F* \ufffdS>Z\ufffd\u0002i\u000e\u0684\ufffd\ufffdQ<X\ufffd\ufffd\u0017\ufffd*5F4\u0013Q\ufffdc0\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003\ufffd\u0005\u001fJlG_\u0016\ufffd\u04bd~b\ufffd\u0010\u04f7?\u0013Q\ufffd'nV\ufffd\b\ufffd\u0017J\ufffd\ufffd+ F* \ufffdS>Z\ufffd\u0002i\u000e\u0684\ufffd\ufffdQ<X\ufffd\ufffd\u0017\ufffd*5F4\u0013Q\ufffdc0\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c8c31e3aa2d5b2695929edd449d6b6aea068cc38",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��>��]8N4o����ɿ;� q �OB��$���� � �2]i�T�ͨ�R��� G vП��j��2 �::����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ��>��]8N4o����ɿ;� q �OB��$���� � �2]i�T�ͨ�R��� G vП��j��2 �::����'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "f5ca7bbf6fd294e33f9978628b88a3c2",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 412,
"payload_entropy": 5.928992957182322,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "4b088bb20557ebdcd88288bdaace28dc24bf7235",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "f5ca7bbf6fd294e33f9978628b88a3c2",
"payload_hash": "3aeb381fad477bcd7a4bb603d201aede",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd>\ufffd\u0003\ufffd]8N4o\ufffd\ufffd\u0017\ufffd\ufffd\u027f;\ufffd\u0000q\u001d\ufffdOB\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd \ufffd\u001e\ufffd2]\u0007i\ufffdT\ufffd\u0368\ufffdR\ufffd\ufffd\ufffd\u001c G\u000bv\u041f\ufffd\ufffdj\u0013\ufffd\ufffd2\u0000\ufffd::\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd>\ufffd\u0003\ufffd]8N4o\ufffd\ufffd\u0017\ufffd\ufffd\u027f;\ufffd\u0000q\u001d\ufffdOB\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd \ufffd\u001e\ufffd2]\u0007i\ufffdT\ufffd\u0368\ufffdR\ufffd\ufffd\ufffd\u001c G\u000bv\u041f\ufffd\ufffdj\u0013\ufffd\ufffd2\u0000\ufffd::\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\u001a\u001a\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd>\ufffd\u0003\ufffd]8N4o\ufffd\ufffd\u0017\ufffd\ufffd\u027f;\ufffd\u0000q\u001d\ufffdOB\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd \ufffd\u001e\ufffd2]\u0007i\ufffdT\ufffd\u0368\ufffdR\ufffd\ufffd\ufffd\u001c G\u000bv\u041f\ufffd\ufffdj\u0013\ufffd\ufffd2\u0000\ufffd::\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd>\ufffd\u0003\ufffd]8N4o\ufffd\ufffd\u0017\ufffd\ufffd\u027f;\ufffd\u0000q\u001d\ufffdOB\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd \ufffd\u001e\ufffd2]\u0007i\ufffdT\ufffd\u0368\ufffdR\ufffd\ufffd\ufffd\u001c G\u000bv\u041f\ufffd\ufffdj\u0013\ufffd\ufffd2\u0000\ufffd::\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\u001a\u001a\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd>\ufffd\u0003\ufffd]8N4o\ufffd\ufffd\u0017\ufffd\ufffd\u027f;\ufffd\u0000q\u001d\ufffdOB\ufffd\ufffd$\ufffd\ufffd\ufffd\ufffd \ufffd\u001e\ufffd2]\u0007i\ufffdT\ufffd\u0368\ufffdR\ufffd\ufffd\ufffd\u001c G\u000bv\u041f\ufffd\ufffdj\u0013\ufffd\ufffd2\u0000\ufffd::\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5203b442295d61e8188b9bd39d49ffa7f8850648",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��
Ђ�D�"^}r~҈��]O���&�� ��d �ϝ`IF� �����m�����[�����g�] � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �� Ђ�D�"^}r~҈��]O���&�� ��d �ϝ`IF� �����m�����[�����g�] � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 413,
"payload_entropy": 6.017810843291835,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "bfe7ebd9eacb175e5a75eef65d0215e1d2e6cdfe",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "006315b3ad276906ff11527f9594e5ba",
"payload_hash": "4af96873ba12bf798736fd612b319ee6",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\r\u0402\ufffdD\ufffd\"^}r\u0014~\u0488\ufffd\u0005\ufffd]O\u000f\ufffd\ufffd\ufffd&\ufffd\u0013\ufffd\u001e\ufffd\ufffdd \ufffd\u03dd`IF\u0017\ufffd\u001b\u001d\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd]\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\r\u0402\ufffdD\ufffd\"^}r\u0014~\u0488\ufffd\u0005\ufffd]O\u000f\ufffd\ufffd\ufffd&\ufffd\u0013\ufffd\u001e\ufffd\ufffdd \ufffd\u03dd`IF\u0017\ufffd\u001b\u001d\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd]\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\r\u0402\ufffdD\ufffd\"^}r\u0014~\u0488\ufffd\u0005\ufffd]O\u000f\ufffd\ufffd\ufffd&\ufffd\u0013\ufffd\u001e\ufffd\ufffdd \ufffd\u03dd`IF\u0017\ufffd\u001b\u001d\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd]\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\r\u0402\ufffdD\ufffd\"^}r\u0014~\u0488\ufffd\u0005\ufffd]O\u000f\ufffd\ufffd\ufffd&\ufffd\u0013\ufffd\u001e\ufffd\ufffdd \ufffd\u03dd`IF\u0017\ufffd\u001b\u001d\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd]\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\r\u0402\ufffdD\ufffd\"^}r\u0014~\u0488\ufffd\u0005\ufffd]O\u000f\ufffd\ufffd\ufffd&\ufffd\u0013\ufffd\u001e\ufffd\ufffdd \ufffd\u03dd`IF\u0017\ufffd\u001b\u001d\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffd\ufffd\ufffd\ufffd[\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd]\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c8d6472bc2730da3ff88ee7eb8866ca1f718dd7b",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �"��>§��5\ۖ�qys^��|��]r��,��W &��:�g� � ��,F �C� /��p/�b � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �"��>§��5\ۖ�qys^��|��]r��,��W &��:�g� � ��,F �C� /��p/�b � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 426,
"payload_entropy": 5.984750221998922,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "f6d6ebb473c09615cfd0b11f9093931d",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\"\ufffd\ufffd>\u00a7\ufffd\ufffd5\\\u06d6\ufffdq\u000fys^\ufffd\ufffd|\ufffd\ufffd]r\ufffd\ufffd,\ufffd\ufffdW &\u000e\ufffd\ufffd:\ufffdg\ufffd\u001e\ufffd\t\ufffd\ufffd,F\u0011\u000b\ufffdC\ufffd\u0016\u000b\/\ufffd\ufffdp\/\ufffdb\u0011\u0014\u001e\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\"\ufffd\ufffd>\u00a7\ufffd\ufffd5\\\u06d6\ufffdq\u000fys^\ufffd\ufffd|\ufffd\ufffd]r\ufffd\ufffd,\ufffd\ufffdW &\u000e\ufffd\ufffd:\ufffdg\ufffd\u001e\ufffd\t\ufffd\ufffd,F\u0011\u000b\ufffdC\ufffd\u0016\u000b\/\ufffd\ufffdp\/\ufffdb\u0011\u0014\u001e\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\"\ufffd\ufffd>\u00a7\ufffd\ufffd5\\\u06d6\ufffdq\u000fys^\ufffd\ufffd|\ufffd\ufffd]r\ufffd\ufffd,\ufffd\ufffdW &\u000e\ufffd\ufffd:\ufffdg\ufffd\u001e\ufffd\t\ufffd\ufffd,F\u0011\u000b\ufffdC\ufffd\u0016\u000b\/\ufffd\ufffdp\/\ufffdb\u0011\u0014\u001e\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\"\ufffd\ufffd>\u00a7\ufffd\ufffd5\\\u06d6\ufffdq\u000fys^\ufffd\ufffd|\ufffd\ufffd]r\ufffd\ufffd,\ufffd\ufffdW &\u000e\ufffd\ufffd:\ufffdg\ufffd\u001e\ufffd\t\ufffd\ufffd,F\u0011\u000b\ufffdC\ufffd\u0016\u000b\/\ufffd\ufffdp\/\ufffdb\u0011\u0014\u001e\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\"\ufffd\ufffd>\u00a7\ufffd\ufffd5\\\u06d6\ufffdq\u000fys^\ufffd\ufffd|\ufffd\ufffd]r\ufffd\ufffd,\ufffd\ufffdW &\u000e\ufffd\ufffd:\ufffdg\ufffd\u001e\ufffd\t\ufffd\ufffd,F\u0011\u000b\ufffdC\ufffd\u0016\u000b\/\ufffd\ufffdp\/\ufffdb\u0011\u0014\u001e\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6b3a9c8df6f07d13c932adf709e3a1fd5ce2c33e",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���0� ���F�MEWr���d�� >������� �z�m�KK��K��\�yl���)�$��{�f � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ���0� ���F�MEWr���d�� >������� �z�m�KK��K��\�yl���)�$��{�f � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 424,
"payload_entropy": 5.991736865186175,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "0db37c0a1c5b37359efe84df6acb36c4",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd0\ufffd\u000b\ufffd\u000f\ufffd\u0013\ufffdF\ufffdMEWr\ufffd\ufffd\u0011\ufffdd\ufffd\ufffd\u001e>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffdz\ufffdm\u0003\ufffdKK\ufffd\ufffdK\ufffd\ufffd\\\u0004\ufffdyl\ufffd\ufffd\u0014\ufffd)\ufffd$\ufffd\ufffd{\u000f\ufffd\u0019f\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd0\ufffd\u000b\ufffd\u000f\ufffd\u0013\ufffdF\ufffdMEWr\ufffd\ufffd\u0011\ufffdd\ufffd\ufffd\u001e>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffdz\ufffdm\u0003\ufffdKK\ufffd\ufffdK\ufffd\ufffd\\\u0004\ufffdyl\ufffd\ufffd\u0014\ufffd)\ufffd$\ufffd\ufffd{\u000f\ufffd\u0019f\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd0\ufffd\u000b\ufffd\u000f\ufffd\u0013\ufffdF\ufffdMEWr\ufffd\ufffd\u0011\ufffdd\ufffd\ufffd\u001e>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffdz\ufffdm\u0003\ufffdKK\ufffd\ufffdK\ufffd\ufffd\\\u0004\ufffdyl\ufffd\ufffd\u0014\ufffd)\ufffd$\ufffd\ufffd{\u000f\ufffd\u0019f\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd0\ufffd\u000b\ufffd\u000f\ufffd\u0013\ufffdF\ufffdMEWr\ufffd\ufffd\u0011\ufffdd\ufffd\ufffd\u001e>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffdz\ufffdm\u0003\ufffdKK\ufffd\ufffdK\ufffd\ufffd\\\u0004\ufffdyl\ufffd\ufffd\u0014\ufffd)\ufffd$\ufffd\ufffd{\u000f\ufffd\u0019f\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd0\ufffd\u000b\ufffd\u000f\ufffd\u0013\ufffdF\ufffdMEWr\ufffd\ufffd\u0011\ufffdd\ufffd\ufffd\u001e>\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffdz\ufffdm\u0003\ufffdKK\ufffd\ufffdK\ufffd\ufffd\\\u0004\ufffdyl\ufffd\ufffd\u0014\ufffd)\ufffd$\ufffd\ufffd{\u000f\ufffd\u0019f\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "974d2aad142cf12262524c0fa3952600cc8ee142",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �,m�δq-n6%?I��- YX"��.ͲZा� �f��?�7��S�)Pt�~e"�g���&,��(� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �,m�δq-n6%?I��- YX"��.ͲZा� �f��?�7��S�)Pt�~e"�g���&,��(� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 5.966792149629587,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "d2b56cec91434a50a5ea3ae53d9be921",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003,m\ufffd\u03b4q-\u0019n\u00126%?I\ufffd\ufffd-\tYX\"\ufffd\ufffd.\u0372Z\u093e\u0011\ufffd \ufffdf\ufffd\ufffd?\ufffd7\ufffd\ufffdS\ufffd)Pt\ufffd~e\"\ufffdg\ufffd\u0017\ufffd\ufffd&\u0016,\ufffd\ufffd(\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003,m\ufffd\u03b4q-\u0019n\u00126%?I\ufffd\ufffd-\tYX\"\ufffd\ufffd.\u0372Z\u093e\u0011\ufffd \ufffdf\ufffd\ufffd?\ufffd7\ufffd\ufffdS\ufffd)Pt\ufffd~e\"\ufffdg\ufffd\u0017\ufffd\ufffd&\u0016,\ufffd\ufffd(\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003,m\ufffd\u03b4q-\u0019n\u00126%?I\ufffd\ufffd-\tYX\"\ufffd\ufffd.\u0372Z\u093e\u0011\ufffd \ufffdf\ufffd\ufffd?\ufffd7\ufffd\ufffdS\ufffd)Pt\ufffd~e\"\ufffdg\ufffd\u0017\ufffd\ufffd&\u0016,\ufffd\ufffd(\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003,m\ufffd\u03b4q-\u0019n\u00126%?I\ufffd\ufffd-\tYX\"\ufffd\ufffd.\u0372Z\u093e\u0011\ufffd \ufffdf\ufffd\ufffd?\ufffd7\ufffd\ufffdS\ufffd)Pt\ufffd~e\"\ufffdg\ufffd\u0017\ufffd\ufffd&\u0016,\ufffd\ufffd(\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003,m\ufffd\u03b4q-\u0019n\u00126%?I\ufffd\ufffd-\tYX\"\ufffd\ufffd.\u0372Z\u093e\u0011\ufffd \ufffdf\ufffd\ufffd?\ufffd7\ufffd\ufffdS\ufffd)Pt\ufffd~e\"\ufffdg\ufffd\u0017\ufffd\ufffd&\u0016,\ufffd\ufffd(\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ea2af9e98f5c1009a21192b4d150f77865ce8f25",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
��a��E��㼊��L������q-�:��J��� ��/_1����V
Y+ �n� ���a��qR*�0 >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
��a��E��㼊��L������q-�:��J��� ��/_1����V Y+ �n� ���a��qR*�0 >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"tls_ja3_hash": "c12b4ccd5320bbb380ca1a9df90f771d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 517,
"payload_entropy": 3.941580487518804,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2bc30fe8a9509e231e6d686be81ea57ede3fec2b",
"event_fingerprint": "98d4495cbf8a645ec93d7a50a28f9b472a15d9dc",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"payload_hash": "46eb6b88e4909970e68a42e85440ead0",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffda\ufffd\ufffdE\ufffd\ufffd\u3f0a\ufffd\ufffdL\ufffd\u001a\u0001\ufffd\ufffd\ufffd\u0018\ufffd\ufffdq-\ufffd:\ufffd\ufffdJ\ufffd\ufffd\ufffd \ufffd\ufffd\/_1\ufffd\ufffd\ufffd\ufffdV\nY+\u001d\ufffd\u0010n\ufffd\u001f\ufffd\ufffd\ufffda\ufffd\ufffd\u0019qR*\u0014\ufffd0\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffda\ufffd\ufffdE\ufffd\ufffd\u3f0a\ufffd\ufffdL\ufffd\u001a\u0001\ufffd\ufffd\ufffd\u0018\ufffd\ufffdq-\ufffd:\ufffd\ufffdJ\ufffd\ufffd\ufffd \ufffd\ufffd\/_1\ufffd\ufffd\ufffd\ufffdV\nY+\u001d\ufffd\u0010n\ufffd\u001f\ufffd\ufffd\ufffda\ufffd\ufffd\u0019qR*\u0014\ufffd0\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffda\ufffd\ufffdE\ufffd\ufffd\u3f0a\ufffd\ufffdL\ufffd\u001a\u0001\ufffd\ufffd\ufffd\u0018\ufffd\ufffdq-\ufffd:\ufffd\ufffdJ\ufffd\ufffd\ufffd \ufffd\ufffd\/_1\ufffd\ufffd\ufffd\ufffdV\nY+\u001d\ufffd\u0010n\ufffd\u001f\ufffd\ufffd\ufffda\ufffd\ufffd\u0019qR*\u0014\ufffd0\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffda\ufffd\ufffdE\ufffd\ufffd\u3f0a\ufffd\ufffdL\ufffd\u001a\u0001\ufffd\ufffd\ufffd\u0018\ufffd\ufffdq-\ufffd:\ufffd\ufffdJ\ufffd\ufffd\ufffd \ufffd\ufffd\/_1\ufffd\ufffd\ufffd\ufffdV\nY+\u001d\ufffd\u0010n\ufffd\u001f\ufffd\ufffd\ufffda\ufffd\ufffd\u0019qR*\u0014\ufffd0\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffda\ufffd\ufffdE\ufffd\ufffd\u3f0a\ufffd\ufffdL\ufffd\u001a\u0001\ufffd\ufffd\ufffd\u0018\ufffd\ufffdq-\ufffd:\ufffd\ufffdJ\ufffd\ufffd\ufffd \ufffd\ufffd\/_1\ufffd\ufffd\ufffd\ufffdV\nY+\u001d\ufffd\u0010n\ufffd\u001f\ufffd\ufffd\ufffda\ufffd\ufffd\u0019qR*\u0014\ufffd0\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7790b76afcd3266c548d57cd38fc7b590f5d565e",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��ڃ �ۛZ�J�/
`�J�7�r�8�Z��ŢƠ P̗���� �lى�=�22���_���h+P� �9 � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ��ڃ �ۛZ�J�/ `�J�7�r�8�Z��ŢƠ P̗���� �lى�=�22���_���h+P� �9 � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 426,
"payload_entropy": 5.991740117136404,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "3322cbe6ec288c01be5320a5a62cae40",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0683\f\ufffd\u06dbZ\ufffdJ\ufffd\/\n`\ufffdJ\ufffd7\ufffdr\ufffd\u00028\ufffdZ\ufffd\ufffd\u0162\u01a0 P\u0317\ufffd\ufffd\ufffd\ufffd \ufffdl\u0649\ufffd=\ufffd22\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffdh+P\ufffd\u0012\u001f\ufffd9\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0683\f\ufffd\u06dbZ\ufffdJ\ufffd\/\n`\ufffdJ\ufffd7\ufffdr\ufffd\u00028\ufffdZ\ufffd\ufffd\u0162\u01a0 P\u0317\ufffd\ufffd\ufffd\ufffd \ufffdl\u0649\ufffd=\ufffd22\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffdh+P\ufffd\u0012\u001f\ufffd9\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0683\f\ufffd\u06dbZ\ufffdJ\ufffd\/\n`\ufffdJ\ufffd7\ufffdr\ufffd\u00028\ufffdZ\ufffd\ufffd\u0162\u01a0 P\u0317\ufffd\ufffd\ufffd\ufffd \ufffdl\u0649\ufffd=\ufffd22\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffdh+P\ufffd\u0012\u001f\ufffd9\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0683\f\ufffd\u06dbZ\ufffdJ\ufffd\/\n`\ufffdJ\ufffd7\ufffdr\ufffd\u00028\ufffdZ\ufffd\ufffd\u0162\u01a0 P\u0317\ufffd\ufffd\ufffd\ufffd \ufffdl\u0649\ufffd=\ufffd22\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffdh+P\ufffd\u0012\u001f\ufffd9\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0683\f\ufffd\u06dbZ\ufffdJ\ufffd\/\n`\ufffdJ\ufffd7\ufffdr\ufffd\u00028\ufffdZ\ufffd\ufffd\u0162\u01a0 P\u0317\ufffd\ufffd\ufffd\ufffd \ufffdl\u0649\ufffd=\ufffd22\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffdh+P\ufffd\u0012\u001f\ufffd9\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ccd4669660f7c259f41394dc9e932381fc3ba028",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��R��� o ��J�9�3U�\)�*���)���SO �}I�����/� ��̐|K�tuHe��� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� ��R��� o ��J�9�3U�\)�*���)���SO �}I�����/� ��̐|K�tuHe��� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 6.044478868638512,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "0ab519586f7bac3a555d993d48c08aed",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdR\ufffd\ufffd\ufffd\u000bo\f\ufffd\ufffdJ\ufffd9\ufffd3U\ufffd\\)\b\ufffd*\ufffd\u0005\ufffd\ufffd)\ufffd\ufffd\ufffdSO \ufffd}I\u0096\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd\u0000\ufffd\u0379\ufffd\u0010\u0310\u0007|K\ufffdtuHe\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdR\ufffd\ufffd\ufffd\u000bo\f\ufffd\ufffdJ\ufffd9\ufffd3U\ufffd\\)\b\ufffd*\ufffd\u0005\ufffd\ufffd)\ufffd\ufffd\ufffdSO \ufffd}I\u0096\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd\u0000\ufffd\u0379\ufffd\u0010\u0310\u0007|K\ufffdtuHe\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdR\ufffd\ufffd\ufffd\u000bo\f\ufffd\ufffdJ\ufffd9\ufffd3U\ufffd\\)\b\ufffd*\ufffd\u0005\ufffd\ufffd)\ufffd\ufffd\ufffdSO \ufffd}I\u0096\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd\u0000\ufffd\u0379\ufffd\u0010\u0310\u0007|K\ufffdtuHe\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdR\ufffd\ufffd\ufffd\u000bo\f\ufffd\ufffdJ\ufffd9\ufffd3U\ufffd\\)\b\ufffd*\ufffd\u0005\ufffd\ufffd)\ufffd\ufffd\ufffdSO \ufffd}I\u0096\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd\u0000\ufffd\u0379\ufffd\u0010\u0310\u0007|K\ufffdtuHe\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdR\ufffd\ufffd\ufffd\u000bo\f\ufffd\ufffdJ\ufffd9\ufffd3U\ufffd\\)\b\ufffd*\ufffd\u0005\ufffd\ufffd)\ufffd\ufffd\ufffdSO \ufffd}I\u0096\ufffd\ufffd\ufffd\ufffd\ufffd\/\ufffd\u0000\ufffd\u0379\ufffd\u0010\u0310\u0007|K\ufffdtuHe\ufffd\ufffd\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ba1a0c2005ee9c7a6a528656c4df50b73ec53850",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �5��դ���Cr����wW
�I���؝J3©<� !b��dw{�h���9��ժ��t.�� �,( � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �5��դ���Cr����wW �I���؝J3©<� !b��dw{�h���9��ժ��t.�� �,( � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 416,
"payload_entropy": 5.962798501557844,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "b3f119a011800ec3d3fa0eb71691b5150ff0c999",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"payload_hash": "b90419e72521428e8dc4ccbf433ea2fa",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00035\ufffd\ufffd\u0564\u0018\ufffd\ufffd\ufffdCr\ufffd\ufffd\ufffd\ufffdwW\u0005\n\ufffdI\ufffd\ufffd\ufffd\u061dJ3\u00a9<\ufffd !\u0018b\ufffd\ufffddw{\ufffd\u0013h\ufffd\ufffd\u0004\ufffd9\ufffd\b\ufffd\u056a\ufffd\ufffdt.\ufffd\ufffd \ufffd,(\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00035\ufffd\ufffd\u0564\u0018\ufffd\ufffd\ufffdCr\ufffd\ufffd\ufffd\ufffdwW\u0005\n\ufffdI\ufffd\ufffd\ufffd\u061dJ3\u00a9<\ufffd !\u0018b\ufffd\ufffddw{\ufffd\u0013h\ufffd\ufffd\u0004\ufffd9\ufffd\b\ufffd\u056a\ufffd\ufffdt.\ufffd\ufffd \ufffd,(\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00035\ufffd\ufffd\u0564\u0018\ufffd\ufffd\ufffdCr\ufffd\ufffd\ufffd\ufffdwW\u0005\n\ufffdI\ufffd\ufffd\ufffd\u061dJ3\u00a9<\ufffd !\u0018b\ufffd\ufffddw{\ufffd\u0013h\ufffd\ufffd\u0004\ufffd9\ufffd\b\ufffd\u056a\ufffd\ufffdt.\ufffd\ufffd \ufffd,(\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00035\ufffd\ufffd\u0564\u0018\ufffd\ufffd\ufffdCr\ufffd\ufffd\ufffd\ufffdwW\u0005\n\ufffdI\ufffd\ufffd\ufffd\u061dJ3\u00a9<\ufffd !\u0018b\ufffd\ufffddw{\ufffd\u0013h\ufffd\ufffd\u0004\ufffd9\ufffd\b\ufffd\u056a\ufffd\ufffdt.\ufffd\ufffd \ufffd,(\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u00035\ufffd\ufffd\u0564\u0018\ufffd\ufffd\ufffdCr\ufffd\ufffd\ufffd\ufffdwW\u0005\n\ufffdI\ufffd\ufffd\ufffd\u061dJ3\u00a9<\ufffd !\u0018b\ufffd\ufffddw{\ufffd\u0013h\ufffd\ufffd\u0004\ufffd9\ufffd\b\ufffd\u056a\ufffd\ufffdt.\ufffd\ufffd \ufffd,(\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "96813c02cccca2da60b5a8a02f5c1f1199b7b4aa",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��^lz� �U��:��<{��L�ƷT/m�� ����Y�)ي�Y�ރ�8�ξ$"ȗ�>�]��|� �zz����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� ��^lz� �U��:��<{��L�ƷT/m�� ����Y�)ي�Y�ރ�8�ξ$"ȗ�>�]��|� �zz����'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 �zz 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "8a16654ee32e617fa8f138aade9b2fb4",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 439,
"payload_entropy": 6.020283187290373,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "011c46b52f86ee169ab229e61174e71bf49ba69e",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "8a16654ee32e617fa8f138aade9b2fb4",
"payload_hash": "7a6746a1c21d8d6d149a6002ac3d95c3",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd^lz\u0011\ufffd\u001e\u000e\ufffdU\u0014\ufffd\ufffd:\ufffd\u000e\ufffd<{\ufffd\ufffd\u0014L\ufffd\u01b7T\/m\u0007\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdY\ufffd)\u064a\ufffdY\ufffd\u0783\ufffd\u001a8\ufffd\u03be$\"\u0217\ufffd>\ufffd]\ufffd\ufffd|\ufffd\u0000\ufffdzz\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd^lz\u0011\ufffd\u001e\u000e\ufffdU\u0014\ufffd\ufffd:\ufffd\u000e\ufffd<{\ufffd\ufffd\u0014L\ufffd\u01b7T\/m\u0007\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdY\ufffd)\u064a\ufffdY\ufffd\u0783\ufffd\u001a8\ufffd\u03be$\"\u0217\ufffd>\ufffd]\ufffd\ufffd|\ufffd\u0000\ufffdzz\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffdzz\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd^lz\u0011\ufffd\u001e\u000e\ufffdU\u0014\ufffd\ufffd:\ufffd\u000e\ufffd<{\ufffd\ufffd\u0014L\ufffd\u01b7T\/m\u0007\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdY\ufffd)\u064a\ufffdY\ufffd\u0783\ufffd\u001a8\ufffd\u03be$\"\u0217\ufffd>\ufffd]\ufffd\ufffd|\ufffd\u0000\ufffdzz\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd^lz\u0011\ufffd\u001e\u000e\ufffdU\u0014\ufffd\ufffd:\ufffd\u000e\ufffd<{\ufffd\ufffd\u0014L\ufffd\u01b7T\/m\u0007\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdY\ufffd)\u064a\ufffdY\ufffd\u0783\ufffd\u001a8\ufffd\u03be$\"\u0217\ufffd>\ufffd]\ufffd\ufffd|\ufffd\u0000\ufffdzz\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffdzz\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd^lz\u0011\ufffd\u001e\u000e\ufffdU\u0014\ufffd\ufffd:\ufffd\u000e\ufffd<{\ufffd\ufffd\u0014L\ufffd\u01b7T\/m\u0007\ufffd\ufffd \ufffd\ufffd\ufffd\ufffdY\ufffd)\u064a\ufffdY\ufffd\u0783\ufffd\u001a8\ufffd\u03be$\"\u0217\ufffd>\ufffd]\ufffd\ufffd|\ufffd\u0000\ufffdzz\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0bc6c360b2f5a5b2eb303608432799289fff7695",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �
$����[[� p�̆����G����8 ͝��344��+$�8KPX��;�̊UQf<5� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� � $����[[� p�̆����G����8 ͝��344��+$�8KPX��;�̊UQf<5� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 5.927025394619972,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "736e693f3d52b1c42554624cf51461d4",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0001\u0016\r$\ufffd\ufffd\ufffd\ufffd[[\u0002\ufffd\u001dp\ufffd\u0306\ufffd\u0003\u0011\ufffd\u0003\ufffd\ufffdG\ufffd\u0017\ufffd\ufffd\ufffd8\u000b \u035d\ufffd\u0019\ufffd344\ufffd\ufffd+$\ufffd8KPX\ufffd\ufffd;\ufffd\u030aUQf\u000e<5\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0001\u0016\r$\ufffd\ufffd\ufffd\ufffd[[\u0002\ufffd\u001dp\ufffd\u0306\ufffd\u0003\u0011\ufffd\u0003\ufffd\ufffdG\ufffd\u0017\ufffd\ufffd\ufffd8\u000b \u035d\ufffd\u0019\ufffd344\ufffd\ufffd+$\ufffd8KPX\ufffd\ufffd;\ufffd\u030aUQf\u000e<5\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0001\u0016\r$\ufffd\ufffd\ufffd\ufffd[[\u0002\ufffd\u001dp\ufffd\u0306\ufffd\u0003\u0011\ufffd\u0003\ufffd\ufffdG\ufffd\u0017\ufffd\ufffd\ufffd8\u000b \u035d\ufffd\u0019\ufffd344\ufffd\ufffd+$\ufffd8KPX\ufffd\ufffd;\ufffd\u030aUQf\u000e<5\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0001\u0016\r$\ufffd\ufffd\ufffd\ufffd[[\u0002\ufffd\u001dp\ufffd\u0306\ufffd\u0003\u0011\ufffd\u0003\ufffd\ufffdG\ufffd\u0017\ufffd\ufffd\ufffd8\u000b \u035d\ufffd\u0019\ufffd344\ufffd\ufffd+$\ufffd8KPX\ufffd\ufffd;\ufffd\u030aUQf\u000e<5\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0001\u0016\r$\ufffd\ufffd\ufffd\ufffd[[\u0002\ufffd\u001dp\ufffd\u0306\ufffd\u0003\u0011\ufffd\u0003\ufffd\ufffdG\ufffd\u0017\ufffd\ufffd\ufffd8\u000b \u035d\ufffd\u0019\ufffd344\ufffd\ufffd+$\ufffd8KPX\ufffd\ufffd;\ufffd\u030aUQf\u000e<5\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f378569e180d1fe1dbd247797949787676319611",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T P'�%.�oM[qw,N5ݞf<q��!Z�/Na_� q �?��(�ݚZ��'�8?�0��B�^ NS�N F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T P'�%.�oM[qw,N5ݞf<q��!Z�/Na_� q �?��(�ݚZ��'�8?�0��B�^ NS�N F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 345,
"payload_entropy": 6.00049399450726,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "dba5f6074e75af26ae4ac6bcdf06131c655bc11d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "03a3ad27040f733ee5c9915e0903d028",
"payload_hash": "d018711107f993e9ba0ca751a37fbd6c",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u0002'\ufffd%\u0011.\ufffdoM[\u0012qw,N\u00075\u075ef<q\ufffd\ufffd!Z\ufffd\/Na_\ufffd \u0005q\u001e\u001e\ufffd?\ufffd\ufffd(\ufffd\u075aZ\ufffd\ufffd'\ufffd8?\ufffd0\ufffd\ufffdB\ufffd^\u001f\u001fNS\ufffdN\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u0002'\ufffd%\u0011.\ufffdoM[\u0012qw,N\u00075\u075ef<q\ufffd\ufffd!Z\ufffd\/Na_\ufffd \u0005q\u001e\u001e\ufffd?\ufffd\ufffd(\ufffd\u075aZ\ufffd\ufffd'\ufffd8?\ufffd0\ufffd\ufffdB\ufffd^\u001f\u001fNS\ufffdN\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u0002'\ufffd%\u0011.\ufffdoM[\u0012qw,N\u00075\u075ef<q\ufffd\ufffd!Z\ufffd\/Na_\ufffd \u0005q\u001e\u001e\ufffd?\ufffd\ufffd(\ufffd\u075aZ\ufffd\ufffd'\ufffd8?\ufffd0\ufffd\ufffdB\ufffd^\u001f\u001fNS\ufffdN\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u0002'\ufffd%\u0011.\ufffdoM[\u0012qw,N\u00075\u075ef<q\ufffd\ufffd!Z\ufffd\/Na_\ufffd \u0005q\u001e\u001e\ufffd?\ufffd\ufffd(\ufffd\u075aZ\ufffd\ufffd'\ufffd8?\ufffd0\ufffd\ufffdB\ufffd^\u001f\u001fNS\ufffdN\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\u0002'\ufffd%\u0011.\ufffdoM[\u0012qw,N\u00075\u075ef<q\ufffd\ufffd!Z\ufffd\/Na_\ufffd \u0005q\u001e\u001e\ufffd?\ufffd\ufffd(\ufffd\u075aZ\ufffd\ufffd'\ufffd8?\ufffd0\ufffd\ufffdB\ufffd^\u001f\u001fNS\ufffdN\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ca51996f19396d8928bfeb16151c75b6bf2a31e9",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F BG�yt�!K]E�|�
�|1ȲZg��v��1�v� �k��o�p�Ho��.' ��4�$d�H��<�� D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F BG�yt�!K]E�|� �|1ȲZg��v��1�v� �k��o�p�Ho��.' ��4�$d�H��<�� D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"tls_ja3_hash": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 11,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2c",
"hq"
],
"bytes_in": 331,
"payload_entropy": 5.991431487099349,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "5ea4964083662cfc7b514c9c02916c805265a734",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a96dc3876784813c57d302241e620acd",
"payload_hash": "b083b53cf154bbb602ff4f41b308bead",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003G\ufffdyt\ufffd\u0016!K]E\ufffd|\ufffd\b\r\ufffd|1\u0232Zg\ufffd\ufffdv\ufffd\ufffd1\ufffdv\ufffd\u000b \ufffdk\ufffd\ufffdo\ufffdp\ufffdHo\ufffd\ufffd.'\u001f\ufffd\u0084\ufffd4\ufffd$\u0013d\ufffdH\ufffd\ufffd<\ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003G\ufffdyt\ufffd\u0016!K]E\ufffd|\ufffd\b\r\ufffd|1\u0232Zg\ufffd\ufffdv\ufffd\ufffd1\ufffdv\ufffd\u000b \ufffdk\ufffd\ufffdo\ufffdp\ufffdHo\ufffd\ufffd.'\u001f\ufffd\u0084\ufffd4\ufffd$\u0013d\ufffdH\ufffd\ufffd<\ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003G\ufffdyt\ufffd\u0016!K]E\ufffd|\ufffd\b\r\ufffd|1\u0232Zg\ufffd\ufffdv\ufffd\ufffd1\ufffdv\ufffd\u000b \ufffdk\ufffd\ufffdo\ufffdp\ufffdHo\ufffd\ufffd.'\u001f\ufffd\u0084\ufffd4\ufffd$\u0013d\ufffdH\ufffd\ufffd<\ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003G\ufffdyt\ufffd\u0016!K]E\ufffd|\ufffd\b\r\ufffd|1\u0232Zg\ufffd\ufffdv\ufffd\ufffd1\ufffdv\ufffd\u000b \ufffdk\ufffd\ufffdo\ufffdp\ufffdHo\ufffd\ufffd.'\u001f\ufffd\u0084\ufffd4\ufffd$\u0013d\ufffdH\ufffd\ufffd<\ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003G\ufffdyt\ufffd\u0016!K]E\ufffd|\ufffd\b\r\ufffd|1\u0232Zg\ufffd\ufffdv\ufffd\ufffd1\ufffdv\ufffd\u000b \ufffdk\ufffd\ufffdo\ufffdp\ufffdHo\ufffd\ufffd.'\u001f\ufffd\u0084\ufffd4\ufffd$\u0013d\ufffdH\ufffd\ufffd<\ufffd\ufffd\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3b0c292d42affab9f7753dbb785166abc3c4b148",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �b߷�V�SU �� ���ˉ���a�ˁ�
� cf�p� ���}~"
����V��o٭}�<]E�k �zz����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� �b߷�V�SU �� ���ˉ���a�ˁ� � cf�p� ���}~" ����V��o٭}�<]E�k �zz����'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 ��� 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "c00790d588ad601599338c4cc8b35fc9",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 412,
"payload_entropy": 6.047386939581841,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "017663a1e337abe2a56186df7988a664945e5e46",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c00790d588ad601599338c4cc8b35fc9",
"payload_hash": "f96b8920b8cfa4e245b1bb42e2ca0384",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003b\u07f7\ufffdV\ufffdSU \ufffd\ufffd \ufffd\ufffd\ufffd\u02c9\ufffd\u001b\ufffd\ufffda\ufffd\u02c1\ufffd\n\u001d\u0010\ufffd cf\ufffdp\ufffd\u001a\t\u001f\ufffd\ufffd\ufffd}~\"\n\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffdo\u066d}\ufffd<]E\ufffdk\u0000\ufffdzz\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003b\u07f7\ufffdV\ufffdSU \ufffd\ufffd \ufffd\ufffd\ufffd\u02c9\ufffd\u001b\ufffd\ufffda\ufffd\u02c1\ufffd\n\u001d\u0010\ufffd cf\ufffdp\ufffd\u001a\t\u001f\ufffd\ufffd\ufffd}~\"\n\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffdo\u066d}\ufffd<]E\ufffdk\u0000\ufffdzz\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003b\u07f7\ufffdV\ufffdSU \ufffd\ufffd \ufffd\ufffd\ufffd\u02c9\ufffd\u001b\ufffd\ufffda\ufffd\u02c1\ufffd\n\u001d\u0010\ufffd cf\ufffdp\ufffd\u001a\t\u001f\ufffd\ufffd\ufffd}~\"\n\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffdo\u066d}\ufffd<]E\ufffdk\u0000\ufffdzz\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003b\u07f7\ufffdV\ufffdSU \ufffd\ufffd \ufffd\ufffd\ufffd\u02c9\ufffd\u001b\ufffd\ufffda\ufffd\u02c1\ufffd\n\u001d\u0010\ufffd cf\ufffdp\ufffd\u001a\t\u001f\ufffd\ufffd\ufffd}~\"\n\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffdo\u066d}\ufffd<]E\ufffdk\u0000\ufffdzz\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003b\u07f7\ufffdV\ufffdSU \ufffd\ufffd \ufffd\ufffd\ufffd\u02c9\ufffd\u001b\ufffd\ufffda\ufffd\u02c1\ufffd\n\u001d\u0010\ufffd cf\ufffdp\ufffd\u001a\t\u001f\ufffd\ufffd\ufffd}~\"\n\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffdo\u066d}\ufffd<]E\ufffdk\u0000\ufffdzz\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "48dfaddda4b65bd6ff8074b37561555ffabd01ee",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ����VLH����l�|6�$��
��N�
!Jt �� �g#�3������k���M�'�Qk���G � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ����VLH����l�|6�$�� ��N� !Jt �� �g#�3������k���M�'�Qk���G � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "006315b3ad276906ff11527f9594e5ba",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 413,
"payload_entropy": 6.035811387904875,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "bfe7ebd9eacb175e5a75eef65d0215e1d2e6cdfe",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "006315b3ad276906ff11527f9594e5ba",
"payload_hash": "be3ddd55f73089cb067177b2107c75d5",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\u0007\ufffd\ufffdV\u0004LH\ufffd\ufffd\ufffd\ufffdl\ufffd|6\ufffd$\ufffd\ufffd\n\ufffd\ufffdN\ufffd\r!\u0018J\u0006t \ufffd\u0010\ufffd\f\ufffdg#\ufffd3\u0006\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffdM\ufffd\u0001'\ufffdQk\ufffd\ufffd\ufffdG\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\u0007\ufffd\ufffdV\u0004LH\ufffd\ufffd\ufffd\ufffdl\ufffd|6\ufffd$\ufffd\ufffd\n\ufffd\ufffdN\ufffd\r!\u0018J\u0006t \ufffd\u0010\ufffd\f\ufffdg#\ufffd3\u0006\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffdM\ufffd\u0001'\ufffdQk\ufffd\ufffd\ufffdG\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\u0007\ufffd\ufffdV\u0004LH\ufffd\ufffd\ufffd\ufffdl\ufffd|6\ufffd$\ufffd\ufffd\n\ufffd\ufffdN\ufffd\r!\u0018J\u0006t \ufffd\u0010\ufffd\f\ufffdg#\ufffd3\u0006\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffdM\ufffd\u0001'\ufffdQk\ufffd\ufffd\ufffdG\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\u0007\ufffd\ufffdV\u0004LH\ufffd\ufffd\ufffd\ufffdl\ufffd|6\ufffd$\ufffd\ufffd\n\ufffd\ufffdN\ufffd\r!\u0018J\u0006t \ufffd\u0010\ufffd\f\ufffdg#\ufffd3\u0006\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffdM\ufffd\u0001'\ufffdQk\ufffd\ufffd\ufffdG\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0002\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0002\ufffd\u0007\ufffd\ufffdV\u0004LH\ufffd\ufffd\ufffd\ufffdl\ufffd|6\ufffd$\ufffd\ufffd\n\ufffd\ufffdN\ufffd\r!\u0018J\u0006t \ufffd\u0010\ufffd\f\ufffdg#\ufffd3\u0006\u0007\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffdM\ufffd\u0001'\ufffdQk\ufffd\ufffd\ufffdG\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4220ac1b665c7bd6a6961595452169ac267233a0",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �gؖ��[�\��'�����^4����bl�� �O�
�2���oO��4I�Xa[��$�7Yn鵴& � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �gؖ��[�\��'�����^4����bl�� �O� �2���oO��4I�Xa[��$�7Yn鵴& � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 424,
"payload_entropy": 6.022999627756708,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "6345cde67971a0c9f5f04d3e6964b1c7",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003g\u0616\ufffd\u0001\ufffd[\ufffd\\\ufffd\ufffd'\ufffd\ufffd\ufffd\u0014\ufffd\u0005\ufffd^4\ufffd\ufffd\u0015\ufffd\ufffdbl\ufffd\b\ufffd \ufffd\u001bO\ufffd\r\ufffd2\ufffd\ufffd\ufffdoO\ufffd\ufffd4I\ufffdXa[\ufffd\ufffd$\ufffd7Yn\u9d74&\u0019\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003g\u0616\ufffd\u0001\ufffd[\ufffd\\\ufffd\ufffd'\ufffd\ufffd\ufffd\u0014\ufffd\u0005\ufffd^4\ufffd\ufffd\u0015\ufffd\ufffdbl\ufffd\b\ufffd \ufffd\u001bO\ufffd\r\ufffd2\ufffd\ufffd\ufffdoO\ufffd\ufffd4I\ufffdXa[\ufffd\ufffd$\ufffd7Yn\u9d74&\u0019\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003g\u0616\ufffd\u0001\ufffd[\ufffd\\\ufffd\ufffd'\ufffd\ufffd\ufffd\u0014\ufffd\u0005\ufffd^4\ufffd\ufffd\u0015\ufffd\ufffdbl\ufffd\b\ufffd \ufffd\u001bO\ufffd\r\ufffd2\ufffd\ufffd\ufffdoO\ufffd\ufffd4I\ufffdXa[\ufffd\ufffd$\ufffd7Yn\u9d74&\u0019\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003g\u0616\ufffd\u0001\ufffd[\ufffd\\\ufffd\ufffd'\ufffd\ufffd\ufffd\u0014\ufffd\u0005\ufffd^4\ufffd\ufffd\u0015\ufffd\ufffdbl\ufffd\b\ufffd \ufffd\u001bO\ufffd\r\ufffd2\ufffd\ufffd\ufffdoO\ufffd\ufffd4I\ufffdXa[\ufffd\ufffd$\ufffd7Yn\u9d74&\u0019\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003g\u0616\ufffd\u0001\ufffd[\ufffd\\\ufffd\ufffd'\ufffd\ufffd\ufffd\u0014\ufffd\u0005\ufffd^4\ufffd\ufffd\u0015\ufffd\ufffdbl\ufffd\b\ufffd \ufffd\u001bO\ufffd\r\ufffd2\ufffd\ufffd\ufffdoO\ufffd\ufffd4I\ufffdXa[\ufffd\ufffd$\ufffd7Yn\u9d74&\u0019\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b41c09d314152a34a7b1baf9cd36c332b279b191",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
�������f*{�6�lˣ�7�K)�7#b�$V��< �O.��x`�ػ�Y��1���?����Av�bq* >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
�������f*{�6�lˣ�7�K)�7#b�$V��< �O.��x`�ػ�Y��1���?����Av�bq* >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{
"tls_ja3_hash": "c12b4ccd5320bbb380ca1a9df90f771d",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 8,
"bytes_in": 517,
"payload_entropy": 4.003447381225166,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 0
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2bc30fe8a9509e231e6d686be81ea57ede3fec2b",
"event_fingerprint": "98d4495cbf8a645ec93d7a50a28f9b472a15d9dc",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "c12b4ccd5320bbb380ca1a9df90f771d",
"payload_hash": "f68e3fcab4ef8edca714cc7c217542dc",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf*{\ufffd6\ufffdl\u02e3\ufffd7\ufffdK)\ufffd7#b\u001a\ufffd$V\ufffd\ufffd< \ufffdO.\u0012\ufffd\ufffdx`\ufffd\u063b\ufffd\u0013Y\ufffd\ufffd1\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffdAv\ufffdb\u0004q*\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf*{\ufffd6\ufffdl\u02e3\ufffd7\ufffdK)\ufffd7#b\u001a\ufffd$V\ufffd\ufffd< \ufffdO.\u0012\ufffd\ufffdx`\ufffd\u063b\ufffd\u0013Y\ufffd\ufffd1\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffdAv\ufffdb\u0004q*\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf*{\ufffd6\ufffdl\u02e3\ufffd7\ufffdK)\ufffd7#b\u001a\ufffd$V\ufffd\ufffd< \ufffdO.\u0012\ufffd\ufffdx`\ufffd\u063b\ufffd\u0013Y\ufffd\ufffd1\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffdAv\ufffdb\u0004q*\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf*{\ufffd6\ufffdl\u02e3\ufffd7\ufffdK)\ufffd7#b\u001a\ufffd$V\ufffd\ufffd< \ufffdO.\u0012\ufffd\ufffdx`\ufffd\u063b\ufffd\u0013Y\ufffd\ufffd1\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffdAv\ufffdb\u0004q*\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000*\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-\u0000\u0002\u0001\u0001\u00003\u0000&\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdf*{\ufffd6\ufffdl\u02e3\ufffd7\ufffdK)\ufffd7#b\u001a\ufffd$V\ufffd\ufffd< \ufffdO.\u0012\ufffd\ufffdx`\ufffd\u063b\ufffd\u0013Y\ufffd\ufffd1\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffdAv\ufffdb\u0004q*\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b476be8d5847ece0dbded70a6b7473b56cc660f1",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ���<
���1 ~bn�������T�#��|��P1� YZ?\X��^��X �.*� �h�ޘT' �Z1 � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� ���< ���1 ~bn�������T�#��|��P1� YZ?\X��^��X �.*� �h�ޘT' �Z1 � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 426,
"payload_entropy": 5.965156468440861,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "6fd9bb5b069c0577a7d9c6cca6b37d1c7f8ed18a",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "db8d4ad49cb378fa370b43a61a9b06b6",
"payload_hash": "785bc44ab1d555ace9341e85677dc1c4",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0013\ufffd<\n\ufffd\ufffd\ufffd1\u000b~bn\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd#\ufffd\ufffd|\ufffd\ufffdP1\ufffd YZ?\\X\u001a\ufffd\ufffd^\ufffd\ufffdX\b\t\ufffd.\b*\ufffd\f\ufffdh\ufffd\u0798T'\f\ufffdZ1\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0013\ufffd<\n\ufffd\ufffd\ufffd1\u000b~bn\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd#\ufffd\ufffd|\ufffd\ufffdP1\ufffd YZ?\\X\u001a\ufffd\ufffd^\ufffd\ufffdX\b\t\ufffd.\b*\ufffd\f\ufffdh\ufffd\u0798T'\f\ufffdZ1\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0013\ufffd<\n\ufffd\ufffd\ufffd1\u000b~bn\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd#\ufffd\ufffd|\ufffd\ufffdP1\ufffd YZ?\\X\u001a\ufffd\ufffd^\ufffd\ufffdX\b\t\ufffd.\b*\ufffd\f\ufffdh\ufffd\u0798T'\f\ufffdZ1\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0013\ufffd<\n\ufffd\ufffd\ufffd1\u000b~bn\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd#\ufffd\ufffd|\ufffd\ufffdP1\ufffd YZ?\\X\u001a\ufffd\ufffd^\ufffd\ufffdX\b\t\ufffd.\b*\ufffd\f\ufffdh\ufffd\u0798T'\f\ufffdZ1\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\u0013\ufffd<\n\ufffd\ufffd\ufffd1\u000b~bn\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdT\ufffd#\ufffd\ufffd|\ufffd\ufffdP1\ufffd YZ?\\X\u001a\ufffd\ufffd^\ufffd\ufffdX\b\t\ufffd.\b*\ufffd\f\ufffdh\ufffd\u0798T'\f\ufffdZ1\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "72b13174e362b8709649ba1389cdb9d34196adc7",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �����"�'��L06� [א�Q�����``\ � �,��r�Rq ����b�+S{=��S��3$� � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� �����"�'��L06� [א�Q�����``\ � �,��r�Rq ����b�+S{=��S��3$� � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 426,
"payload_entropy": 5.967983528835866,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "2caba37fca716a89d30b9b51f96ac565",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\"\ufffd'\ufffd\ufffdL06\ufffd\u001c\u001d[\u05d0\ufffdQ\ufffd\u0004\ufffd\u0014\ufffd\ufffd\ufffd``\\\u001d\ufffd \u000f\ufffd,\ufffd\ufffdr\u0003\ufffdRq\u0019\u001d\ufffd\ufffd\ufffd\ufffdb\ufffd+S\u0019{=\ufffd\ufffdS\ufffd\ufffd3\u0010$\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\"\ufffd'\ufffd\ufffdL06\ufffd\u001c\u001d[\u05d0\ufffdQ\ufffd\u0004\ufffd\u0014\ufffd\ufffd\ufffd``\\\u001d\ufffd \u000f\ufffd,\ufffd\ufffdr\u0003\ufffdRq\u0019\u001d\ufffd\ufffd\ufffd\ufffdb\ufffd+S\u0019{=\ufffd\ufffdS\ufffd\ufffd3\u0010$\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\"\ufffd'\ufffd\ufffdL06\ufffd\u001c\u001d[\u05d0\ufffdQ\ufffd\u0004\ufffd\u0014\ufffd\ufffd\ufffd``\\\u001d\ufffd \u000f\ufffd,\ufffd\ufffdr\u0003\ufffdRq\u0019\u001d\ufffd\ufffd\ufffd\ufffdb\ufffd+S\u0019{=\ufffd\ufffdS\ufffd\ufffd3\u0010$\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\"\ufffd'\ufffd\ufffdL06\ufffd\u001c\u001d[\u05d0\ufffdQ\ufffd\u0004\ufffd\u0014\ufffd\ufffd\ufffd``\\\u001d\ufffd \u000f\ufffd,\ufffd\ufffdr\u0003\ufffdRq\u0019\u001d\ufffd\ufffd\ufffd\ufffdb\ufffd+S\u0019{=\ufffd\ufffdS\ufffd\ufffd3\u0010$\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\"\ufffd'\ufffd\ufffdL06\ufffd\u001c\u001d[\u05d0\ufffdQ\ufffd\u0004\ufffd\u0014\ufffd\ufffd\ufffd``\\\u001d\ufffd \u000f\ufffd,\ufffd\ufffdr\u0003\ufffdRq\u0019\u001d\ufffd\ufffd\ufffd\ufffdb\ufffd+S\u0019{=\ufffd\ufffdS\ufffd\ufffd3\u0010$\ufffd\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9c6dacc84b71266a51970aeb52b6ba0ae0d76f6f",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �_�)��K���^�KWh \���콭G4% ��ؑ�ɦg>��J��<9�'2Ų }QD�Z 2� � 3 g���� � 9 k���� � E � � � ��� �#�����+�
�$��
Requête brute (extrait)
� �_�)��K���^�KWh \���콭G4% ��ؑ�ɦg>��J��<9�'2Ų }QD�Z 2� � 3 g���� � 9 k���� � E � � � ��� �#�����+� �$�����,�r�s̩�����'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 416,
"payload_entropy": 5.944213216938158,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "b3f119a011800ec3d3fa0eb71691b5150ff0c999",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "917fde1bf3bcb67f961b77b18d9ee14a",
"payload_hash": "17c6a3439e32714ef5f73fa2372f9cb9",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003_\ufffd)\ufffd\ufffd\u0003K\ufffd\u0012\u0011\ufffd\ufffd^\ufffdKWh\u0000\u0006\\\u0018\ufffd\u0015\ufffd\ufffd\ucf6dG4%\u0006 \ufffd\ufffd\u0611\ufffd\u0266g>\ufffd\ufffdJ\ufffd\ufffd<9\ufffd'2\u0172\f}QD\ufffdZ\u001f\t\u00142\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003_\ufffd)\ufffd\ufffd\u0003K\ufffd\u0012\u0011\ufffd\ufffd^\ufffdKWh\u0000\u0006\\\u0018\ufffd\u0015\ufffd\ufffd\ucf6dG4%\u0006 \ufffd\ufffd\u0611\ufffd\u0266g>\ufffd\ufffdJ\ufffd\ufffd<9\ufffd'2\u0172\f}QD\ufffdZ\u001f\t\u00142\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003_\ufffd)\ufffd\ufffd\u0003K\ufffd\u0012\u0011\ufffd\ufffd^\ufffdKWh\u0000\u0006\\\u0018\ufffd\u0015\ufffd\ufffd\ucf6dG4%\u0006 \ufffd\ufffd\u0611\ufffd\u0266g>\ufffd\ufffdJ\ufffd\ufffd<9\ufffd'2\u0172\f}QD\ufffdZ\u001f\t\u00142\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003_\ufffd)\ufffd\ufffd\u0003K\ufffd\u0012\u0011\ufffd\ufffd^\ufffdKWh\u0000\u0006\\\u0018\ufffd\u0015\ufffd\ufffd\ucf6dG4%\u0006 \ufffd\ufffd\u0611\ufffd\u0266g>\ufffd\ufffdJ\ufffd\ufffd<9\ufffd'2\u0172\f}QD\ufffdZ\u001f\t\u00142\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003_\ufffd)\ufffd\ufffd\u0003K\ufffd\u0012\u0011\ufffd\ufffd^\ufffdKWh\u0000\u0006\\\u0018\ufffd\u0015\ufffd\ufffd\ucf6dG4%\u0006 \ufffd\ufffd\u0611\ufffd\u0266g>\ufffd\ufffdJ\ufffd\ufffd<9\ufffd'2\u0172\f}QD\ufffdZ\u001f\t\u00142\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5bed5a1d4f1a2c3d4357939867d5d097034c8173",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� �ɺ2�٤�u�>I�xf��9~� �(����] �)�s�M��;C���ٻ��6���4f0���p��� �ZZ����'��/��(̩�0�s�`�r�a�,�v���w��̨�$
Requête brute (extrait)
� �ɺ2�٤�u�>I�xf��9~� �(����] �)�s�M��;C���ٻ��6���4f0���p��� �ZZ����'��/��(̩�0�s�`�r�a�,�v���w��̨�$� �+�������# � /� < ��� ��� � � � 5 E = ��������� � k A 9 � � ��� ��� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "16d255281908aa85e9ce8440c90352c8",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"hq",
"h2c",
"h2",
"spdy\/3",
"spdy\/2",
"spdy\/1",
"http\/1.1",
"http\/1.0",
"http\/0.9"
],
"bytes_in": 439,
"payload_entropy": 6.03166067337413,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "349c3028d9e71ed02aa9db1a897ce5f4eb502e67",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "16d255281908aa85e9ce8440c90352c8",
"payload_hash": "711cf5252ee949373496e43e8b7b9a9e",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0080\u027a2\ufffd\u0664\ufffdu\ufffd>I\ufffdxf\u0019\ufffd\ufffd9~\ufffd\u001e\ufffd(\ufffd\u0017\ufffd\ufffd\ufffd] \ufffd)\ufffds\ufffdM\ufffd\u0012\ufffd;C\ufffd\ufffd\ufffd\u067b\ufffd\ufffd6\ufffd\ufffd\ufffd4f0\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\u0000\ufffdZZ\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0080\u027a2\ufffd\u0664\ufffdu\ufffd>I\ufffdxf\u0019\ufffd\ufffd9~\ufffd\u001e\ufffd(\ufffd\u0017\ufffd\ufffd\ufffd] \ufffd)\ufffds\ufffdM\ufffd\u0012\ufffd;C\ufffd\ufffd\ufffd\u067b\ufffd\ufffd6\ufffd\ufffd\ufffd4f0\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\u0000\ufffdZZ\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\u001a\u001a\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0080\u027a2\ufffd\u0664\ufffdu\ufffd>I\ufffdxf\u0019\ufffd\ufffd9~\ufffd\u001e\ufffd(\ufffd\u0017\ufffd\ufffd\ufffd] \ufffd)\ufffds\ufffdM\ufffd\u0012\ufffd;C\ufffd\ufffd\ufffd\u067b\ufffd\ufffd6\ufffd\ufffd\ufffd4f0\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\u0000\ufffdZZ\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0080\u027a2\ufffd\u0664\ufffdu\ufffd>I\ufffdxf\u0019\ufffd\ufffd9~\ufffd\u001e\ufffd(\ufffd\u0017\ufffd\ufffd\ufffd] \ufffd)\ufffds\ufffdM\ufffd\u0012\ufffd;C\ufffd\ufffd\ufffd\u067b\ufffd\ufffd6\ufffd\ufffd\ufffd4f0\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\u0000\ufffdZZ\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005\ufffd\n\u0013\u0004\ufffd+\u0013\u0003\ufffd\ufffd\ufffd\u0013\ufffd\ufffd\ufffd\u0011\ufffd#\u0000\n\ufffd\t\u0000\/\ufffd\b\u0000<\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u00005\u0000E\u0000=\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000k\u0000A\u00009\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\ufffd\u0000\ufffd\ufffd\ufffd\u0000\u0007\u0000g\u0000\u0004\u00003\u0000\u0005\u0000\u0016\u0001\u0000\u0000\ufffd\u001a\u001a\u0000\u0000\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001",
"payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0080\u027a2\ufffd\u0664\ufffdu\ufffd>I\ufffdxf\u0019\ufffd\ufffd9~\ufffd\u001e\ufffd(\ufffd\u0017\ufffd\ufffd\ufffd] \ufffd)\ufffds\ufffdM\ufffd\u0012\ufffd;C\ufffd\ufffd\ufffd\u067b\ufffd\ufffd6\ufffd\ufffd\ufffd4f0\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd\u0000\ufffdZZ\ufffd\u0012\ufffd\u0013\ufffd\u0007\ufffd'\ufffd\u0014\ufffd\/\u0013\u0001\ufffd\u0014\u0013\u0002\ufffd(\u0329\ufffd0\ufffds\ufffd`\ufffdr\ufffda\ufffd,\ufffdv\ufffd\ufffd\ufffdw\ufffd\ufffd\u0328\ufffd$\u0013\u0005",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f85bc1e36faa806198c1950d29dd51ba190f32c7",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
� ��x��̈́�IK�8��rc� �j�����, 5� ����^fϢ�{.ڱ�����`_a� aQ���O � � � � A ����� = 5 ����� < /
��̨�w
Requête brute (extrait)
� ��x��̈́�IK�8��rc� �j�����, 5� ����^fϢ�{.ڱ�����`_a� aQ���O � � � � A ����� = 5 ����� < / ��̨�w�v�a�`�0�(��/�'����̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 �
Meta JSON brut
{
"tls_ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 20,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 424,
"payload_entropy": 6.014179768368311,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "ff19976c871073407e7e76337ccaaf0eaa7e82cf",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "013c30c8ce44c8b27e9ceb2a14db7283",
"payload_hash": "7fb2b4c390898550873cda1e9e2b0f9f",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdx\ufffd\ufffd\u0344\ufffdIK\ufffd8\ufffd\ufffdrc\ufffd\u061c\u001b\u000b\ufffdj\ufffd\ufffd\ufffd\ufffd\ufffd,\u000b\u00145\ufffd \ufffd\ufffd\ufffd\ufffd^f\u0007\u03e2\ufffd{.\u06b1\ufffd\u0017\ufffd\ufffd\ufffd\ufffd`_a\ufffd\u001faQ\ufffd\ufffd\u000f\ufffdO\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdx\ufffd\ufffd\u0344\ufffdIK\ufffd8\ufffd\ufffdrc\ufffd\u061c\u001b\u000b\ufffdj\ufffd\ufffd\ufffd\ufffd\ufffd,\u000b\u00145\ufffd \ufffd\ufffd\ufffd\ufffd^f\u0007\u03e2\ufffd{.\u06b1\ufffd\u0017\ufffd\ufffd\ufffd\ufffd`_a\ufffd\u001faQ\ufffd\ufffd\u000f\ufffdO\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdx\ufffd\ufffd\u0344\ufffdIK\ufffd8\ufffd\ufffdrc\ufffd\u061c\u001b\u000b\ufffdj\ufffd\ufffd\ufffd\ufffd\ufffd,\u000b\u00145\ufffd \ufffd\ufffd\ufffd\ufffd^f\u0007\u03e2\ufffd{.\u06b1\ufffd\u0017\ufffd\ufffd\ufffd\ufffd`_a\ufffd\u001faQ\ufffd\ufffd\u000f\ufffdO\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdx\ufffd\ufffd\u0344\ufffdIK\ufffd8\ufffd\ufffdrc\ufffd\u061c\u001b\u000b\ufffdj\ufffd\ufffd\ufffd\ufffd\ufffd,\u000b\u00145\ufffd \ufffd\ufffd\ufffd\ufffd^f\u0007\u03e2\ufffd{.\u06b1\ufffd\u0017\ufffd\ufffd\ufffd\ufffd`_a\ufffd\u001faQ\ufffd\ufffd\u000f\ufffdO\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw\ufffdv\ufffda\ufffd`\ufffd0\ufffd(\ufffd\u0014\ufffd\/\ufffd'\ufffd\u0013\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000",
"payload_snippet": "\u0016\u0003\u0003\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdx\ufffd\ufffd\u0344\ufffdIK\ufffd8\ufffd\ufffdrc\ufffd\u061c\u001b\u000b\ufffdj\ufffd\ufffd\ufffd\ufffd\ufffd,\u000b\u00145\ufffd \ufffd\ufffd\ufffd\ufffd^f\u0007\u03e2\ufffd{.\u06b1\ufffd\u0017\ufffd\ufffd\ufffd\ufffd`_a\ufffd\u001faQ\ufffd\ufffd\u000f\ufffdO\u0000\ufffd\u0000\u0005\u0000\u0004\u0000\u0007\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000A\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000=\u00005\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000<\u0000\/\u0000\n\ufffd\u0011\ufffd\u0013\u0013\u0003\u0013\u0004\u0013\u0005\u0328\ufffdw",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b5857556fffa042545c20af97d5433d68ecce404",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
T P�n^�8 �;�����(�X�Yɢ�+ך���!,� '�Ѱo�>��>D2��{��^�}�W$L�-B
F���̩�s�r�,�����$�
�+�����#� � � � � � E �
Requête brute (extrait)
T P�n^�8 �;�����(�X�Yɢ�+ך���!,� '�Ѱo�>��>D2��{��^�}�W$L�-B F���̩�s�r�,�����$� �+�����#� � � � � � E ����� k 9 ����� g 3 � 62.3.50.33 � # < :http/0.9http/1.0http/1.1spdy/1spdy/2
Meta JSON brut
{
"tls_ja3_hash": "03a3ad27040f733ee5c9915e0903d028",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 9,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"http\/1.1",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2",
"h2c",
"hq"
],
"bytes_in": 345,
"payload_entropy": 6.057760191173436,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "dba5f6074e75af26ae4ac6bcdf06131c655bc11d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "03a3ad27040f733ee5c9915e0903d028",
"payload_hash": "69dc76e82eb0d9e3b090e9c1b64ea21f",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffdn^\ufffd8\u001c\b\ufffd;\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffdX\ufffdY\u0262\ufffd+\u05da\ufffd\ufffd\ufffd!,\ufffd \u0006'\u0012\ufffd\u0470o\ufffd>\ufffd\ufffd>D2\ufffd\ufffd{\ufffd\ufffd\u0004^\ufffd}\ufffd\u001aW$L\ufffd-B\n\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffdn^\ufffd8\u001c\b\ufffd;\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffdX\ufffdY\u0262\ufffd+\u05da\ufffd\ufffd\ufffd!,\ufffd \u0006'\u0012\ufffd\u0470o\ufffd>\ufffd\ufffd>D2\ufffd\ufffd{\ufffd\ufffd\u0004^\ufffd}\ufffd\u001aW$L\ufffd-B\n\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffdn^\ufffd8\u001c\b\ufffd;\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffdX\ufffdY\u0262\ufffd+\u05da\ufffd\ufffd\ufffd!,\ufffd \u0006'\u0012\ufffd\u0470o\ufffd>\ufffd\ufffd>D2\ufffd\ufffd{\ufffd\ufffd\u0004^\ufffd}\ufffd\u001aW$L\ufffd-B\n\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffdn^\ufffd8\u001c\b\ufffd;\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffdX\ufffdY\u0262\ufffd+\u05da\ufffd\ufffd\ufffd!,\ufffd \u0006'\u0012\ufffd\u0470o\ufffd>\ufffd\ufffd>D2\ufffd\ufffd{\ufffd\ufffd\u0004^\ufffd}\ufffd\u001aW$L\ufffd-B\n\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000k\u00009\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\u0000g\u00003\u0000\u0016\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000<\u0000:\bhttp\/0.9\bhttp\/1.0\bhttp\/1.1\u0006spdy\/1\u0006spdy\/2",
"payload_snippet": "\u0016\u0003\u0003\u0001T\u0001\u0000\u0001P\u0003\u0003\ufffdn^\ufffd8\u001c\b\ufffd;\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffdX\ufffdY\u0262\ufffd+\u05da\ufffd\ufffd\ufffd!,\ufffd \u0006'\u0012\ufffd\u0470o\ufffd>\ufffd\ufffd>D2\ufffd\ufffd{\ufffd\ufffd\u0004^\ufffd}\ufffd\u001aW$L\ufffd-B\n\u0000F\ufffd\u0012\ufffd\u0007\ufffd\u0014\u0013\u0001\u0013\u0002\u0329\ufffds\ufffdr\ufffd,\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd\n\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd#\ufffd\t\ufffd\b\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000E\u0000\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "29f377771a499324a676a533a497af0bef320b6f",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|
|
|
TCP |
82
|
tls
|
Sonde TLS
|
Élevée
|
Faible · 22
|
|
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_sni_ip
tls_weak_cipher
Cible HTTP
—
TLS SNI
62.3.50.33
Capteur
paris-1
|
Méthode
—
Port
82
Chemin / cible
—
Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
F B`�E���:M��t^�qua�#lqCk/�m�`� _�piNEZ��?o�*��W�t\(������N�y D��'�/��(�0�`�a�v�w̨��
/ <���� � 5 =��
Requête brute (extrait)
F B`�E���:M��t^�qua�#lqCk/�m�`� _�piNEZ��?o�*��W�t\(������N�y D��'�/��(�0�`�a�v�w̨�� / <���� � 5 =���� � A � � � � 62.3.50.33 � # 0 .http/0.9http/1.0spdy/1spdy/2spdy/3h2c
Meta JSON brut
{
"tls_ja3_hash": "a96dc3876784813c57d302241e620acd",
"tls_sni": "62.3.50.33",
"tls_weak_cipher": true,
"tls_weak_cipher_count": 11,
"tls_alpn": [
"http\/0.9",
"http\/1.0",
"spdy\/1",
"spdy\/2",
"spdy\/3",
"h2c",
"hq"
],
"bytes_in": 331,
"payload_entropy": 6.05036397726216,
"port_category": "well_known",
"org": "HostRoyale Technologies Pvt Ltd",
"service": "tls",
"app_proto": "tls",
"asn": 39486,
"country": "BE",
"dst_port": 82,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 22,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "12efa11c211bffd6c3bc2a33de3994cdc2bdb0fb",
"event_fingerprint": "5ea4964083662cfc7b514c9c02916c805265a734",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "BE",
"asn": 39486,
"org": "HostRoyale Technologies Pvt Ltd",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "a96dc3876784813c57d302241e620acd",
"payload_hash": "87557d1f0e9a54763afdb3d9f6f14a08",
"path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c"
},
"target_context": {
"dst_port": 82,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003`\ufffdE\ufffd\ufffd\ufffd:M\ufffd\u0003\ufffdt^\u070f\ufffdqua\ufffd#lqCk\/\ufffdm\ufffd`\ufffd _\ufffdpiNEZ\ufffd\ufffd?o\ufffd*\ufffd\ufffd\u000eW\ufffdt\\(\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\ufffdN\ufffdy\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003`\ufffdE\ufffd\ufffd\ufffd:M\ufffd\u0003\ufffdt^\u070f\ufffdqua\ufffd#lqCk\/\ufffdm\ufffd`\ufffd _\ufffdpiNEZ\ufffd\ufffd?o\ufffd*\ufffd\ufffd\u000eW\ufffdt\\(\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\ufffdN\ufffdy\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003`\ufffdE\ufffd\ufffd\ufffd:M\ufffd\u0003\ufffdt^\u070f\ufffdqua\ufffd#lqCk\/\ufffdm\ufffd`\ufffd _\ufffdpiNEZ\ufffd\ufffd?o\ufffd*\ufffd\ufffd\u000eW\ufffdt\\(\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\ufffdN\ufffdy\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"evidence": {
"request_sample": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003`\ufffdE\ufffd\ufffd\ufffd:M\ufffd\u0003\ufffdt^\u070f\ufffdqua\ufffd#lqCk\/\ufffdm\ufffd`\ufffd _\ufffdpiNEZ\ufffd\ufffd?o\ufffd*\ufffd\ufffd\u000eW\ufffdt\\(\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\ufffdN\ufffdy\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0000\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0017\u0000\u0000\u0000\u0001\u0000\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u00000\u0000.\bhttp\/0.9\bhttp\/1.0\u0006spdy\/1\u0006spdy\/2\u0006spdy\/3\u0003h2c",
"payload_snippet": "\u0016\u0003\u0003\u0001F\u0001\u0000\u0001B\u0003\u0003`\ufffdE\ufffd\ufffd\ufffd:M\ufffd\u0003\ufffdt^\u070f\ufffdqua\ufffd#lqCk\/\ufffdm\ufffd`\ufffd _\ufffdpiNEZ\ufffd\ufffd?o\ufffd*\ufffd\ufffd\u000eW\ufffdt\\(\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\ufffdN\ufffdy\u0000D\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd",
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4754a10b7c32fd593203baf54e52407b20a60508",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_sni_ip",
"tls_weak_cipher"
]
}
|