{"ip":"104.155.55.96","exported_at":"2026-10-23T07:08:22+00:00","period_days":30,"metrics":{"events7d":22,"distinct_ports":1,"distinct_classifications":5,"max_severity":7,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":56,"attack_stage":"exploit_attempt","attack_chain_stage":"exploitation","threat_family":["unknown"],"recommended_action":"monitor","confidence":0.59,"risk_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":40,"protocol":33,"novelty":15},"mitre_tactics":["TA0001","TA0002"],"mitre_technique":"TA0001","top_mitre_technique":"TA0007","top_mitre_count":15,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTPS","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":40,"protocol":33,"novelty":15,"risk_score":49},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":59,"confidence_hint_fr":null,"sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0284"],"tags_summary":["pat-0284"],"attack_vector":"xss attack \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)","protocol_details":{"payload_preview":"GET \/downloads\/ HTTP\/1.1\r\nRange: bytes=0-65535\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible)\r\nAccept: text\/html,appli","port":8443,"service":"https","service_label_fr":"HTTPS"},"protocol_summary_fr":"Payload GET \/downloads\/ HTTP\/1.1\r\nRange: bytes=0-65535\r\nConnection: clo\u2026 \u00b7 HTTPS:8443","evidence_snippet":"GET \/downloads\/ HTTP\/1.1\r\nRange: bytes=0-65535\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible)\r\nAccept: text\/html,appli","target_port_label":"8443 \u00b7 HTTPS","emulator_service":"https","confidence_reason":"Confiance 59 % \u2014 Motif catalogue confirm\u00e9","classification_reason":"Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%","classification_reason_label_fr":"Type \u00ab Cross-site scripting \u00bb (signaux protocolaires) \u00b7 confiance 59%","confidence_factors_fr":"Confiance 59 % \u2014 Score WAF 8","payload_preview":"GET \/downloads\/ HTTP\/1.1\r\nRange: bytes=0-65535\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (compatible)\r\nAccept: text\/html,appli","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"96.55.155.104.dnsbl.blacklistip.com","listed":false,"available":false,"response":null,"meaning":null,"label":null},"events":[{"id":4504024,"ip":"104.155.55.96","ts":"2026-10-19 04:47:18.000000","proto":"tcp","src_port":45066,"dst_port":8443,"service":"https","classification":"xss_attack","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 187, \u0022payload_entropy\u0022: 5.350416732574139, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 49, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222aa17a6b515596b20eaea8d57184d62da9f48dfc\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022confidence\u0022: 0.59, \u0022classification_confidence\u0022: 0.59, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0284\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0284\u0022], \u0022matched_patterns\u0022: [\u0022pat-0284\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 941130\u0022], \u0022pattern_ids\u0022: [\u0022pat-0284\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 59.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022206687c9f8582725072b757343a06462\u0022, \u0022path_pattern_hash\u0022: \u0022e84c630ed8a3a6084c1b662f626e7300\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 49}, \u0022payload_preview\u0022: \u0022GET \/downloads\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,appli\u0022, \u0022request_sample\u0022: \u0022GET \/downloads\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,application\/xhtml+xml;q=0.9,*\/*;q=0.8\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/downloads\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,appli\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/downloads\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,application\/xhtml+xml;q=0.9,*\/*;q=0.8\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/downloads\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,appli\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c7cbdfd57f5142d958b49cc38eae66be617ca0ba\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/downloads\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,appli\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/downloads\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,appli\u0022, \u0022attack_vector\u0022: \u0022xss attack \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 59 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 59, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 49, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0284\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0284\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/downloads\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,appli\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022xss attack \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/downloads\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,appli\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 59 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 59 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":187},{"id":4504023,"ip":"104.155.55.96","ts":"2026-10-19 04:47:18.000000","proto":"tcp","src_port":45062,"dst_port":8443,"service":"https","classification":"minecraft_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.88162680510834, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022confidence\u0022: 0.42, \u0022classification_confidence\u0022: 0.42, \u0022precision_score\u0022: 50, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0554\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 42.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002260d13bdbe1a7b5a7b0bdffd24c4f6c2c\u0022, \u0022path_pattern_hash\u0022: \u0022796c509ff0514fcb64ff9e5a1c4b51db\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u001e\ufffd\ufffd\\u001c.\ufffd\u0026\u003E\ufffd\ufffdTM\ufffdmKq_\ufffd\\u001a\ufffd\ufffd\ufffd\\u001f-Rj~\\u0013\\u0002\ufffd \\u0004G\\r\u01e3\ufffd\ufffdy0\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffdbr\\u0019\ufffd \ufffd\ufffdi\ufffdrT\\u000f\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u001e\ufffd\ufffd\\u001c.\ufffd\u0026\u003E\ufffd\ufffdTM\ufffdmKq_\ufffd\\u001a\ufffd\ufffd\ufffd\\u001f-Rj~\\u0013\\u0002\ufffd \\u0004G\\r\u01e3\ufffd\ufffdy0\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffdbr\\u0019\ufffd \ufffd\ufffdi\ufffdrT\\u000f\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u0017\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u001e\ufffd\ufffd\\u001c.\ufffd\u0026\u003E\ufffd\ufffdTM\ufffdmKq_\ufffd\\u001a\ufffd\ufffd\ufffd\\u001f-Rj~\\u0013\\u0002\ufffd \\u0004G\\r\u01e3\ufffd\ufffdy0\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffdbr\\u0019\ufffd \ufffd\ufffdi\ufffdrT\\u000f\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022game_server_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fa074d09be9fa056df6aa1714dd0a72dfe706bc6\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u001e\ufffd\ufffd\\u001c.\ufffd\u0026\u003E\ufffd\ufffdTM\ufffdmKq_\ufffd\\u001a\ufffd\ufffd\ufffd\\u001f-Rj~\\u0013\\u0002\ufffd \\u0004G\\r\u01e3\ufffd\ufffdy0\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffdbr\\u0019\ufffd \ufffd\ufffdi\ufffdrT\\u000f\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd.\ufffd\u0026\u003E\ufffd\ufffdTM\ufffdmKq_\ufffd\ufffd\ufffd\ufffd-Rj~\ufffd G\\r\u01e3\ufffd\ufffdy0\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffdbr\ufffd \ufffd\ufffdi\ufffdrT\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 42, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\\u001e\ufffd\ufffd\\u001c.\ufffd\u0026\u003E\ufffd\ufffdTM\ufffdmKq_\ufffd\\u001a\ufffd\ufffd\ufffd\\u001f-Rj~\\u0013\\u0002\ufffd \\u0004G\\r\u01e3\ufffd\ufffdy0\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffdbr\\u0019\ufffd \ufffd\ufffdi\ufffdrT\\u000f\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd.\ufffd\u0026\u003E\ufffd\ufffdTM\ufffdmKq_\ufffd\ufffd\ufffd\ufffd-Rj~\ufffd G\\r\u01e3\ufffd\ufffdy0\ufffd\ufffd\ufffdT\ufffd\ufffd\ufffd\ufffd\ufffdbr\ufffd \ufffd\ufffdi\ufffdrT\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 42 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":517},{"id":4504013,"ip":"104.155.55.96","ts":"2026-10-19 04:47:17.000000","proto":"tcp","src_port":45042,"dst_port":8443,"service":"https","classification":"xss_attack","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 183, \u0022payload_entropy\u0022: 5.327657538093535, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 49, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222aa17a6b515596b20eaea8d57184d62da9f48dfc\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022confidence\u0022: 0.59, \u0022classification_confidence\u0022: 0.59, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0284\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0284\u0022], \u0022matched_patterns\u0022: [\u0022pat-0284\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 941130\u0022], \u0022pattern_ids\u0022: [\u0022pat-0284\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 59.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022a11b470d0ca0d11382eb5a91e375f68e\u0022, \u0022path_pattern_hash\u0022: \u0022e84c630ed8a3a6084c1b662f626e7300\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 49}, \u0022payload_preview\u0022: \u0022GET \/files\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,applicati\u0022, \u0022request_sample\u0022: \u0022GET \/files\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,application\/xhtml+xml;q=0.9,*\/*;q=0.8\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,applicati\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/files\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,application\/xhtml+xml;q=0.9,*\/*;q=0.8\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,applicati\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220d01599acd3d1d9322b49891fb447ea009a0417c\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/files\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,applicati\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/files\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,applicati\u0022, \u0022attack_vector\u0022: \u0022xss attack \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 59 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 59, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 49, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0284\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0284\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/files\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,applicati\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022xss attack \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/files\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,applicati\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 59 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 59 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":183},{"id":4504012,"ip":"104.155.55.96","ts":"2026-10-19 04:47:17.000000","proto":"tcp","src_port":45034,"dst_port":8443,"service":"https","classification":"minecraft_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.864879797903101, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022confidence\u0022: 0.42, \u0022classification_confidence\u0022: 0.42, \u0022precision_score\u0022: 50, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0554\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 42.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022d93013424aefe9b932275a0498343fd0\u0022, \u0022path_pattern_hash\u0022: \u0022796c509ff0514fcb64ff9e5a1c4b51db\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd7\ufffd\ufffd\u003C\u072aze\ufffd\\u0015J\ufffdx\\\u0022\\u0004\\u0014{9X\\\u0022\ufffd\ufffdN\ufffdQ\ufffd\ufffdn\ufffdT \u003E\\fW\ufffd}g\u0188\\u0007\ufffdt\\rZk\ufffd\\u0001r\/\ufffd\ufffd{\ufffd\\f\ufffd\ufffdU\ufffd\\u001d\ufffdh\u003E\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd7\ufffd\ufffd\u003C\u072aze\ufffd\\u0015J\ufffdx\\\u0022\\u0004\\u0014{9X\\\u0022\ufffd\ufffdN\ufffdQ\ufffd\ufffdn\ufffdT \u003E\\fW\ufffd}g\u0188\\u0007\ufffdt\\rZk\ufffd\\u0001r\/\ufffd\ufffd{\ufffd\\f\ufffd\ufffdU\ufffd\\u001d\ufffdh\u003E\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u0017\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd7\ufffd\ufffd\u003C\u072aze\ufffd\\u0015J\ufffdx\\\u0022\\u0004\\u0014{9X\\\u0022\ufffd\ufffdN\ufffdQ\ufffd\ufffdn\ufffdT \u003E\\fW\ufffd}g\u0188\\u0007\ufffdt\\rZk\ufffd\\u0001r\/\ufffd\ufffd{\ufffd\\f\ufffd\ufffdU\ufffd\\u001d\ufffdh\u003E\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022game_server_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002218fa202d781308bf2a36741c580724e80cb3e1e6\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd7\ufffd\ufffd\u003C\u072aze\ufffd\\u0015J\ufffdx\\\u0022\\u0004\\u0014{9X\\\u0022\ufffd\ufffdN\ufffdQ\ufffd\ufffdn\ufffdT \u003E\\fW\ufffd}g\u0188\\u0007\ufffdt\\rZk\ufffd\\u0001r\/\ufffd\ufffd{\ufffd\\f\ufffd\ufffdU\ufffd\\u001d\ufffdh\u003E\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd7\ufffd\ufffd\u003C\u072aze\ufffdJ\ufffdx\\\u0022{9X\\\u0022\ufffd\ufffdN\ufffdQ\ufffd\ufffdn\ufffdT \u003EW\ufffd}g\u0188\ufffdt\\rZk\ufffdr\/\ufffd\ufffd{\ufffd\ufffd\ufffdU\ufffd\ufffdh\u003E\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 42, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd7\ufffd\ufffd\u003C\u072aze\ufffd\\u0015J\ufffdx\\\u0022\\u0004\\u0014{9X\\\u0022\ufffd\ufffdN\ufffdQ\ufffd\ufffdn\ufffdT \u003E\\fW\ufffd}g\u0188\\u0007\ufffdt\\rZk\ufffd\\u0001r\/\ufffd\ufffd{\ufffd\\f\ufffd\ufffdU\ufffd\\u001d\ufffdh\u003E\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd7\ufffd\ufffd\u003C\u072aze\ufffdJ\ufffdx\\\u0022{9X\\\u0022\ufffd\ufffdN\ufffdQ\ufffd\ufffdn\ufffdT \u003EW\ufffd}g\u0188\ufffdt\\rZk\ufffdr\/\ufffd\ufffd{\ufffd\ufffd\ufffdU\ufffd\ufffdh\u003E\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 42 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":517},{"id":4504011,"ip":"104.155.55.96","ts":"2026-10-19 04:47:17.000000","proto":"tcp","src_port":45032,"dst_port":8443,"service":"https","classification":"minecraft_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.864580770407893, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022confidence\u0022: 0.42, \u0022classification_confidence\u0022: 0.42, \u0022precision_score\u0022: 50, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0554\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 42.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022b37de9aac3fd29d1eb22068fdfd59435\u0022, \u0022path_pattern_hash\u0022: \u0022796c509ff0514fcb64ff9e5a1c4b51db\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\/S\\u0019i\ufffd9r]\u0027\\u0006\ufffdS\ufffd`\ufffd\ufffd@\ufffd\ufffd\u06d2E\ufffd7\u06c5\ufffd\ufffd\u07c3\\u0003\ufffd y\\u000f\ufffd\\\u0022\ufffd\\u0006\ufffd\ufffd\\u0003MV\ufffdL\ufffd\\u0017\ufffdd)\ufffd_\ufffd\ufffd7\\u000f\ufffdV\ufffd\ufffdc\ufffd\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\/S\\u0019i\ufffd9r]\u0027\\u0006\ufffdS\ufffd`\ufffd\ufffd@\ufffd\ufffd\u06d2E\ufffd7\u06c5\ufffd\ufffd\u07c3\\u0003\ufffd y\\u000f\ufffd\\\u0022\ufffd\\u0006\ufffd\ufffd\\u0003MV\ufffdL\ufffd\\u0017\ufffdd)\ufffd_\ufffd\ufffd7\\u000f\ufffdV\ufffd\ufffdc\ufffd\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u0017\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\/S\\u0019i\ufffd9r]\u0027\\u0006\ufffdS\ufffd`\ufffd\ufffd@\ufffd\ufffd\u06d2E\ufffd7\u06c5\ufffd\ufffd\u07c3\\u0003\ufffd y\\u000f\ufffd\\\u0022\ufffd\\u0006\ufffd\ufffd\\u0003MV\ufffdL\ufffd\\u0017\ufffdd)\ufffd_\ufffd\ufffd7\\u000f\ufffdV\ufffd\ufffdc\ufffd\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022game_server_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022135b6079a43cd1a224f49c947918963f3c3db4cd\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\/S\\u0019i\ufffd9r]\u0027\\u0006\ufffdS\ufffd`\ufffd\ufffd@\ufffd\ufffd\u06d2E\ufffd7\u06c5\ufffd\ufffd\u07c3\\u0003\ufffd y\\u000f\ufffd\\\u0022\ufffd\\u0006\ufffd\ufffd\\u0003MV\ufffdL\ufffd\\u0017\ufffdd)\ufffd_\ufffd\ufffd7\\u000f\ufffdV\ufffd\ufffdc\ufffd\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\/Si\ufffd9r]\u0027\ufffdS\ufffd`\ufffd\ufffd@\ufffd\ufffd\u06d2E\ufffd7\u06c5\ufffd\ufffd\u07c3\ufffd y\ufffd\\\u0022\ufffd\ufffd\ufffdMV\ufffdL\ufffd\ufffdd)\ufffd_\ufffd\ufffd7\ufffdV\ufffd\ufffdc\ufffd\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 42, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\/S\\u0019i\ufffd9r]\u0027\\u0006\ufffdS\ufffd`\ufffd\ufffd@\ufffd\ufffd\u06d2E\ufffd7\u06c5\ufffd\ufffd\u07c3\\u0003\ufffd y\\u000f\ufffd\\\u0022\ufffd\\u0006\ufffd\ufffd\\u0003MV\ufffdL\ufffd\\u0017\ufffdd)\ufffd_\ufffd\ufffd7\\u000f\ufffdV\ufffd\ufffdc\ufffd\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\/Si\ufffd9r]\u0027\ufffdS\ufffd`\ufffd\ufffd@\ufffd\ufffd\u06d2E\ufffd7\u06c5\ufffd\ufffd\u07c3\ufffd y\ufffd\\\u0022\ufffd\ufffd\ufffdMV\ufffdL\ufffd\ufffdd)\ufffd_\ufffd\ufffd7\ufffdV\ufffd\ufffdc\ufffd\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 42 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":517},{"id":4504010,"ip":"104.155.55.96","ts":"2026-10-19 04:47:17.000000","proto":"tcp","src_port":45020,"dst_port":8443,"service":"https","classification":"http_smuggling_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 118, \u0022payload_entropy\u0022: 5.060392386289598, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 85.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 85.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 56, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e6b2cf8ce9f9336bf0fcf7e6fb346b1f13664c68\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 84, \u0022precision_signals\u0022: [\u0022pat-0842\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0842\u0022], \u0022matched_patterns\u0022: [\u0022pat-0842\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 921130 duplicate CL\u0022], \u0022pattern_ids\u0022: [\u0022pat-0842\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 85.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 56}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002239a2197dc1fc88d3ffb36ad1e70905f1\u0022, \u0022path_pattern_hash\u0022: \u002206b55a159b5d265fc8976ebb0a005f8a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 56}, \u0022payload_preview\u0022: \u0022POST \/ HTTP\/1.1\\r\\nContent-Length: 0\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022request_sample\u0022: \u0022POST \/ HTTP\/1.1\\r\\nContent-Length: 0\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022POST \/ HTTP\/1.1\\r\\nContent-Length: 0\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022POST \/ HTTP\/1.1\\r\\nContent-Length: 0\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022POST \/ HTTP\/1.1\\r\\nContent-Length: 0\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022web_injection\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223b94309ae7918eee2707e66f528a614b471ab0dd\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022POST \/ HTTP\/1.1\\r\\nContent-Length: 0\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/ HTTP\/1.1\\r\\nContent-Length: 0\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022attack_vector\u0022: \u0022http smuggling probe \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 85.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 56}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 56, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0842\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0842\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022POST \/ HTTP\/1.1\\r\\nContent-Length: 0\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http smuggling probe \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022POST \/ HTTP\/1.1\\r\\nContent-Length: 0\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":118},{"id":4504008,"ip":"104.155.55.96","ts":"2026-10-19 04:47:17.000000","proto":"tcp","src_port":45006,"dst_port":8443,"service":"https","classification":"minecraft_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.909659518708599, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022confidence\u0022: 0.42, \u0022classification_confidence\u0022: 0.42, \u0022precision_score\u0022: 50, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0554\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 42.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00220f9e5acdbef681fbf799fd12e8951b95\u0022, \u0022path_pattern_hash\u0022: \u0022796c509ff0514fcb64ff9e5a1c4b51db\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdb\ufffd\u0189\ufffd\ufffd\ufffd\ufffd;x\\u000f\ufffd\ufffd$\ufffd\ufffd\ufffd\\u000f:\ufffd\\u000e\ufffd\\u0013\ufffdu\ufffd\ufffdYF \ufffd1\\u0005\\u0015\ufffd3\ufffd\ufffdZ\\u0015\ufffdY`\ufffd\ufffd\ufffd \ufffdO\ufffdo+\\n#\ufffd\ufffd=\ufffd^R\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdb\ufffd\u0189\ufffd\ufffd\ufffd\ufffd;x\\u000f\ufffd\ufffd$\ufffd\ufffd\ufffd\\u000f:\ufffd\\u000e\ufffd\\u0013\ufffdu\ufffd\ufffdYF \ufffd1\\u0005\\u0015\ufffd3\ufffd\ufffdZ\\u0015\ufffdY`\ufffd\ufffd\ufffd \ufffdO\ufffdo+\\n#\ufffd\ufffd=\ufffd^R\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u0017\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdb\ufffd\u0189\ufffd\ufffd\ufffd\ufffd;x\\u000f\ufffd\ufffd$\ufffd\ufffd\ufffd\\u000f:\ufffd\\u000e\ufffd\\u0013\ufffdu\ufffd\ufffdYF \ufffd1\\u0005\\u0015\ufffd3\ufffd\ufffdZ\\u0015\ufffdY`\ufffd\ufffd\ufffd \ufffdO\ufffdo+\\n#\ufffd\ufffd=\ufffd^R\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022game_server_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022dc8ef755bd1a24d04893b55a6a1678beab955fb9\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdb\ufffd\u0189\ufffd\ufffd\ufffd\ufffd;x\\u000f\ufffd\ufffd$\ufffd\ufffd\ufffd\\u000f:\ufffd\\u000e\ufffd\\u0013\ufffdu\ufffd\ufffdYF \ufffd1\\u0005\\u0015\ufffd3\ufffd\ufffdZ\\u0015\ufffdY`\ufffd\ufffd\ufffd \ufffdO\ufffdo+\\n#\ufffd\ufffd=\ufffd^R\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdb\ufffd\u0189\ufffd\ufffd\ufffd\ufffd;x\ufffd\ufffd$\ufffd\ufffd\ufffd:\ufffd\ufffd\ufffdu\ufffd\ufffdYF \ufffd1\ufffd3\ufffd\ufffdZ\ufffdY`\ufffd\ufffd\ufffd \ufffdO\ufffdo+\\n#\ufffd\ufffd=\ufffd^R\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 42, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdb\ufffd\u0189\ufffd\ufffd\ufffd\ufffd;x\\u000f\ufffd\ufffd$\ufffd\ufffd\ufffd\\u000f:\ufffd\\u000e\ufffd\\u0013\ufffdu\ufffd\ufffdYF \ufffd1\\u0005\\u0015\ufffd3\ufffd\ufffdZ\\u0015\ufffdY`\ufffd\ufffd\ufffd \ufffdO\ufffdo+\\n#\ufffd\ufffd=\ufffd^R\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdb\ufffd\u0189\ufffd\ufffd\ufffd\ufffd;x\ufffd\ufffd$\ufffd\ufffd\ufffd:\ufffd\ufffd\ufffdu\ufffd\ufffdYF \ufffd1\ufffd3\ufffd\ufffdZ\ufffdY`\ufffd\ufffd\ufffd \ufffdO\ufffdo+\\n#\ufffd\ufffd=\ufffd^R\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 42 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":517},{"id":4504007,"ip":"104.155.55.96","ts":"2026-10-19 04:47:17.000000","proto":"tcp","src_port":45000,"dst_port":8443,"service":"https","classification":"web_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 99, \u0022payload_entropy\u0022: 5.061351070410738, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 42.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 43, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e6b2cf8ce9f9336bf0fcf7e6fb346b1f13664c68\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0419\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0419\u0022], \u0022matched_patterns\u0022: [\u0022pat-0419\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP HEAD method\u0022], \u0022pattern_ids\u0022: [\u0022pat-0419\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 43}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c8125dce994eebb1500d487ee0f3db14\u0022, \u0022path_pattern_hash\u0022: \u00224154520a4208b3f021f35a6cc1dd98ae\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 43}, \u0022payload_preview\u0022: \u0022HEAD \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022request_sample\u0022: \u0022HEAD \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022HEAD \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022HEAD \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022HEAD \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002248ed5afcd5a74af0757e3a7d75533e8c7e3ade9b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022HEAD \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022HEAD \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 43\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 43}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 43, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0419\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0419\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022HEAD \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022HEAD \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":99},{"id":4504006,"ip":"104.155.55.96","ts":"2026-10-19 04:47:16.000000","proto":"tcp","src_port":44988,"dst_port":8443,"service":"https","classification":"xss_attack","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 181, \u0022payload_entropy\u0022: 5.3448889094132435, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 49, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222aa17a6b515596b20eaea8d57184d62da9f48dfc\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022confidence\u0022: 0.59, \u0022classification_confidence\u0022: 0.59, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0284\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0284\u0022], \u0022matched_patterns\u0022: [\u0022pat-0284\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 941130\u0022], \u0022pattern_ids\u0022: [\u0022pat-0284\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 59.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222f39340fabf4210d2dac692d4c5dd56e\u0022, \u0022path_pattern_hash\u0022: \u0022e84c630ed8a3a6084c1b662f626e7300\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 49}, \u0022payload_preview\u0022: \u0022GET \/pub\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,application\u0022, \u0022request_sample\u0022: \u0022GET \/pub\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,application\/xhtml+xml;q=0.9,*\/*;q=0.8\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/pub\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,application\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/pub\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,application\/xhtml+xml;q=0.9,*\/*;q=0.8\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/pub\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,application\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220035be096abb7313b09453639b9c984be1309582\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/pub\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,application\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/pub\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,application\u0022, \u0022attack_vector\u0022: \u0022xss attack \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 59 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 59, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 49, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0284\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0284\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/pub\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,application\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022xss attack \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/pub\/ HTTP\/1.1\\r\\nRange: bytes=0-65535\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nAccept: text\/html,application\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 59 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 59 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true, \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 96}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":181},{"id":4504005,"ip":"104.155.55.96","ts":"2026-10-19 04:47:16.000000","proto":"tcp","src_port":44998,"dst_port":8443,"service":"https","classification":"minecraft_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.917296533993076, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022confidence\u0022: 0.42, \u0022classification_confidence\u0022: 0.42, \u0022precision_score\u0022: 50, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0554\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 42.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002298d94a0966dbe5ed9028c1873aedf5fe\u0022, \u0022path_pattern_hash\u0022: \u0022796c509ff0514fcb64ff9e5a1c4b51db\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\b\ufffd\ufffdzom\\u0016V\ufffd\ufffd\ufffd~\ufffd=\ufffdu\ufffd\\u001f\\\u0022?\ufffd\u0654\ufffdT\ufffdYJ\ufffd\ufffd \u041b\ufffd7\u0206\ufffd\ufffdS\ufffd\ufffd}90\ufffdaS@@\ufffd.]7r\ufffd=\ufffd2\\\u0022G\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\b\ufffd\ufffdzom\\u0016V\ufffd\ufffd\ufffd~\ufffd=\ufffdu\ufffd\\u001f\\\u0022?\ufffd\u0654\ufffdT\ufffdYJ\ufffd\ufffd \u041b\ufffd7\u0206\ufffd\ufffdS\ufffd\ufffd}90\ufffdaS@@\ufffd.]7r\ufffd=\ufffd2\\\u0022G\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u0017\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\b\ufffd\ufffdzom\\u0016V\ufffd\ufffd\ufffd~\ufffd=\ufffdu\ufffd\\u001f\\\u0022?\ufffd\u0654\ufffdT\ufffdYJ\ufffd\ufffd \u041b\ufffd7\u0206\ufffd\ufffdS\ufffd\ufffd}90\ufffdaS@@\ufffd.]7r\ufffd=\ufffd2\\\u0022G\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022game_server_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b12df394db7d2caa5d19f4085c56133438b7970a\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\b\ufffd\ufffdzom\\u0016V\ufffd\ufffd\ufffd~\ufffd=\ufffdu\ufffd\\u001f\\\u0022?\ufffd\u0654\ufffdT\ufffdYJ\ufffd\ufffd \u041b\ufffd7\u0206\ufffd\ufffdS\ufffd\ufffd}90\ufffdaS@@\ufffd.]7r\ufffd=\ufffd2\\\u0022G\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdzomV\ufffd\ufffd\ufffd~\ufffd=\ufffdu\ufffd\\\u0022?\ufffd\u0654\ufffdT\ufffdYJ\ufffd\ufffd \u041b\ufffd7\u0206\ufffd\ufffdS\ufffd\ufffd}90\ufffdaS@@\ufffd.]7r\ufffd=\ufffd2\\\u0022G\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 42, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\\b\ufffd\ufffdzom\\u0016V\ufffd\ufffd\ufffd~\ufffd=\ufffdu\ufffd\\u001f\\\u0022?\ufffd\u0654\ufffdT\ufffdYJ\ufffd\ufffd \u041b\ufffd7\u0206\ufffd\ufffdS\ufffd\ufffd}90\ufffdaS@@\ufffd.]7r\ufffd=\ufffd2\\\u0022G\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdzomV\ufffd\ufffd\ufffd~\ufffd=\ufffdu\ufffd\\\u0022?\ufffd\u0654\ufffdT\ufffdYJ\ufffd\ufffd \u041b\ufffd7\u0206\ufffd\ufffdS\ufffd\ufffd}90\ufffdaS@@\ufffd.]7r\ufffd=\ufffd2\\\u0022G\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 42 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":517},{"id":4504003,"ip":"104.155.55.96","ts":"2026-10-19 04:47:16.000000","proto":"tcp","src_port":44976,"dst_port":8443,"service":"https","classification":"minecraft_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.877954047913188, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022confidence\u0022: 0.42, \u0022classification_confidence\u0022: 0.42, \u0022precision_score\u0022: 50, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0554\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 42.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00221b2742c597dc8a5754bb75e643bb678f\u0022, \u0022path_pattern_hash\u0022: \u0022796c509ff0514fcb64ff9e5a1c4b51db\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdhP\ufffd\ufffd\ufffd\ufffd\ufffdr\\u001f\ufffd\\u0007_\ufffd\ufffdUq\u02ab\ufffdT\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd \ufffdPg\ufffd\ufffd\ufffd\ufffd\ufffd\\u0018wF\ufffda\ufffdl\\u000e\ufffd\\u0007q\ufffd|:\ufffd\\u00029\ufffd\\u0017\ufffd\u03bbA\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdhP\ufffd\ufffd\ufffd\ufffd\ufffdr\\u001f\ufffd\\u0007_\ufffd\ufffdUq\u02ab\ufffdT\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd \ufffdPg\ufffd\ufffd\ufffd\ufffd\ufffd\\u0018wF\ufffda\ufffdl\\u000e\ufffd\\u0007q\ufffd|:\ufffd\\u00029\ufffd\\u0017\ufffd\u03bbA\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u0017\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdhP\ufffd\ufffd\ufffd\ufffd\ufffdr\\u001f\ufffd\\u0007_\ufffd\ufffdUq\u02ab\ufffdT\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd \ufffdPg\ufffd\ufffd\ufffd\ufffd\ufffd\\u0018wF\ufffda\ufffdl\\u000e\ufffd\\u0007q\ufffd|:\ufffd\\u00029\ufffd\\u0017\ufffd\u03bbA\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022game_server_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fe8887e611c454c7d657af46d70aae7297e2e976\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdhP\ufffd\ufffd\ufffd\ufffd\ufffdr\\u001f\ufffd\\u0007_\ufffd\ufffdUq\u02ab\ufffdT\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd \ufffdPg\ufffd\ufffd\ufffd\ufffd\ufffd\\u0018wF\ufffda\ufffdl\\u000e\ufffd\\u0007q\ufffd|:\ufffd\\u00029\ufffd\\u0017\ufffd\u03bbA\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdhP\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffd_\ufffd\ufffdUq\u02ab\ufffdT\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd \ufffdPg\ufffd\ufffd\ufffd\ufffd\ufffdwF\ufffda\ufffdl\ufffdq\ufffd|:\ufffd9\ufffd\ufffd\u03bbA\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 42, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdhP\ufffd\ufffd\ufffd\ufffd\ufffdr\\u001f\ufffd\\u0007_\ufffd\ufffdUq\u02ab\ufffdT\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd \ufffdPg\ufffd\ufffd\ufffd\ufffd\ufffd\\u0018wF\ufffda\ufffdl\\u000e\ufffd\\u0007q\ufffd|:\ufffd\\u00029\ufffd\\u0017\ufffd\u03bbA\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdhP\ufffd\ufffd\ufffd\ufffd\ufffdr\ufffd_\ufffd\ufffdUq\u02ab\ufffdT\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd \ufffdPg\ufffd\ufffd\ufffd\ufffd\ufffdwF\ufffda\ufffdl\ufffdq\ufffd|:\ufffd9\ufffd\ufffd\u03bbA\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 42 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":517},{"id":4504001,"ip":"104.155.55.96","ts":"2026-10-19 04:47:16.000000","proto":"tcp","src_port":44952,"dst_port":8443,"service":"https","classification":"minecraft_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.869391715178361, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022confidence\u0022: 0.42, \u0022classification_confidence\u0022: 0.42, \u0022precision_score\u0022: 50, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0554\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 42.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002295d0760c45b2826b7a7da6c5be0b650e\u0022, \u0022path_pattern_hash\u0022: \u0022796c509ff0514fcb64ff9e5a1c4b51db\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdns.P,\ufffd\u07afr\ufffd]rYoK\ufffd\ufffd\\tLFQ\ufffd\u003E)\\u000f\ufffd\ufffdplI (\ufffd\ufffd\ub0cf\\u000b\\u0004\ufffd\\u0013\ufffd\\b._R\ufffd+\ufffd\\u000b3\ufffdj\\u001d\ufffd\\u000ej\ufffd\ufffd\ufffdL(\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdns.P,\ufffd\u07afr\ufffd]rYoK\ufffd\ufffd\\tLFQ\ufffd\u003E)\\u000f\ufffd\ufffdplI (\ufffd\ufffd\ub0cf\\u000b\\u0004\ufffd\\u0013\ufffd\\b._R\ufffd+\ufffd\\u000b3\ufffdj\\u001d\ufffd\\u000ej\ufffd\ufffd\ufffdL(\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u0017\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdns.P,\ufffd\u07afr\ufffd]rYoK\ufffd\ufffd\\tLFQ\ufffd\u003E)\\u000f\ufffd\ufffdplI (\ufffd\ufffd\ub0cf\\u000b\\u0004\ufffd\\u0013\ufffd\\b._R\ufffd+\ufffd\\u000b3\ufffdj\\u001d\ufffd\\u000ej\ufffd\ufffd\ufffdL(\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022game_server_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002278ed2723cf5cfddfa754eb4b32a274ea2cf5d736\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdns.P,\ufffd\u07afr\ufffd]rYoK\ufffd\ufffd\\tLFQ\ufffd\u003E)\\u000f\ufffd\ufffdplI (\ufffd\ufffd\ub0cf\\u000b\\u0004\ufffd\\u0013\ufffd\\b._R\ufffd+\ufffd\\u000b3\ufffdj\\u001d\ufffd\\u000ej\ufffd\ufffd\ufffdL(\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdns.P,\ufffd\u07afr\ufffd]rYoK\ufffd\ufffd\\tLFQ\ufffd\u003E)\ufffd\ufffdplI (\ufffd\ufffd\ub0cf\ufffd\ufffd._R\ufffd+\ufffd3\ufffdj\ufffdj\ufffd\ufffd\ufffdL(\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 42, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdns.P,\ufffd\u07afr\ufffd]rYoK\ufffd\ufffd\\tLFQ\ufffd\u003E)\\u000f\ufffd\ufffdplI (\ufffd\ufffd\ub0cf\\u000b\\u0004\ufffd\\u0013\ufffd\\b._R\ufffd+\ufffd\\u000b3\ufffdj\\u001d\ufffd\\u000ej\ufffd\ufffd\ufffdL(\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdns.P,\ufffd\u07afr\ufffd]rYoK\ufffd\ufffd\\tLFQ\ufffd\u003E)\ufffd\ufffdplI (\ufffd\ufffd\ub0cf\ufffd\ufffd._R\ufffd+\ufffd3\ufffdj\ufffdj\ufffd\ufffd\ufffdL(\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 42 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":517},{"id":4503996,"ip":"104.155.55.96","ts":"2026-10-19 04:47:16.000000","proto":"tcp","src_port":44928,"dst_port":8443,"service":"https","classification":"mozi_pattern","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 109, \u0022payload_entropy\u0022: 5.0645426471262045, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 82.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 41, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222aa17a6b515596b20eaea8d57184d62da9f48dfc\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 41}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00229db3fd5059b3f7ea0761ab3b516fa9c5\u0022, \u0022path_pattern_hash\u0022: \u0022762d384fab941f6d0c2239f19994f30e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 41}, \u0022payload_preview\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022request_sample\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022mitre_tactics\u0022: [\u0022TA0011\u0022], \u0022mitre\u0022: \u0022TA0011\u0022, \u0022threat_family\u0022: [\u0022botnet\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022318d166e14ee737b080fb8ffc44e1be9f61e1d4b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via HTTPS:8443 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 41\/100 (Moyen) \u2014 MITRE TA0011 \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 41}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022attack_stage_label\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022risk_score\u0022: 41, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0011\u0022, \u0022mitre_technique\u0022: \u0022TA0011\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via HTTPS:8443 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022command_and_control\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":109},{"id":4503995,"ip":"104.155.55.96","ts":"2026-10-19 04:47:16.000000","proto":"tcp","src_port":44942,"dst_port":8443,"service":"https","classification":"mozi_pattern","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 99, \u0022payload_entropy\u0022: 5.0891782168972375, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 82.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 41, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e6b2cf8ce9f9336bf0fcf7e6fb346b1f13664c68\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 41}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002268e52560b9f141962a7b6b79692feaad\u0022, \u0022path_pattern_hash\u0022: \u0022762d384fab941f6d0c2239f19994f30e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 41}, \u0022payload_preview\u0022: \u0022VEAX \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022request_sample\u0022: \u0022VEAX \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022VEAX \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022VEAX \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022VEAX \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022mitre_tactics\u0022: [\u0022TA0011\u0022], \u0022mitre\u0022: \u0022TA0011\u0022, \u0022threat_family\u0022: [\u0022botnet\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002287846a2e4a50ccd483daf465f0f8b3afab0ae7e9\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022VEAX \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022VEAX \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via HTTPS:8443 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 41\/100 (Moyen) \u2014 MITRE TA0011 \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 41}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022attack_stage_label\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022risk_score\u0022: 41, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0011\u0022, \u0022mitre_technique\u0022: \u0022TA0011\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022VEAX \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via HTTPS:8443 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022evidence_snippet\u0022: \u0022VEAX \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022command_and_control\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":99},{"id":4503994,"ip":"104.155.55.96","ts":"2026-10-19 04:47:16.000000","proto":"tcp","src_port":44926,"dst_port":8443,"service":"https","classification":"minecraft_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.876264343237872, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022confidence\u0022: 0.42, \u0022classification_confidence\u0022: 0.42, \u0022precision_score\u0022: 50, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0554\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 42.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222d4708592c42870c36ee37039373de5f\u0022, \u0022path_pattern_hash\u0022: \u0022796c509ff0514fcb64ff9e5a1c4b51db\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdnf-D\\u001b5c\ufffd#\u0027V\ufffdrK\ufffd\ufffd\\u0007T\ufffdrTCd\\t\ufffd:\ufffd\u04da\ufffd \\u0018dY\ufffd\ufffd\ufffd\ufffd\\u000f\\u0002C\ufffd\ufffd\\u0019\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffd,9\ufffd\u99de\\u001d\\b\ufffd\ufffd\\u0015#\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdnf-D\\u001b5c\ufffd#\u0027V\ufffdrK\ufffd\ufffd\\u0007T\ufffdrTCd\\t\ufffd:\ufffd\u04da\ufffd \\u0018dY\ufffd\ufffd\ufffd\ufffd\\u000f\\u0002C\ufffd\ufffd\\u0019\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffd,9\ufffd\u99de\\u001d\\b\ufffd\ufffd\\u0015#\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u0017\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdnf-D\\u001b5c\ufffd#\u0027V\ufffdrK\ufffd\ufffd\\u0007T\ufffdrTCd\\t\ufffd:\ufffd\u04da\ufffd \\u0018dY\ufffd\ufffd\ufffd\ufffd\\u000f\\u0002C\ufffd\ufffd\\u0019\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffd,9\ufffd\u99de\\u001d\\b\ufffd\ufffd\\u0015#\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022game_server_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d3abb5b41682181fe5da0c9c083cb7a555327642\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdnf-D\\u001b5c\ufffd#\u0027V\ufffdrK\ufffd\ufffd\\u0007T\ufffdrTCd\\t\ufffd:\ufffd\u04da\ufffd \\u0018dY\ufffd\ufffd\ufffd\ufffd\\u000f\\u0002C\ufffd\ufffd\\u0019\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffd,9\ufffd\u99de\\u001d\\b\ufffd\ufffd\\u0015#\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdnf-D5c\ufffd#\u0027V\ufffdrK\ufffd\ufffdT\ufffdrTCd\\t\ufffd:\ufffd\u04da\ufffd dY\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffd,9\ufffd\u99de\ufffd\ufffd#\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 42, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffdnf-D\\u001b5c\ufffd#\u0027V\ufffdrK\ufffd\ufffd\\u0007T\ufffdrTCd\\t\ufffd:\ufffd\u04da\ufffd \\u0018dY\ufffd\ufffd\ufffd\ufffd\\u000f\\u0002C\ufffd\ufffd\\u0019\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffd,9\ufffd\u99de\\u001d\\b\ufffd\ufffd\\u0015#\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdnf-D5c\ufffd#\u0027V\ufffdrK\ufffd\ufffdT\ufffdrTCd\\t\ufffd:\ufffd\u04da\ufffd dY\ufffd\ufffd\ufffd\ufffdC\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd7\ufffd\ufffd,9\ufffd\u99de\ufffd\ufffd#\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 42 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":517},{"id":4503993,"ip":"104.155.55.96","ts":"2026-10-19 04:47:16.000000","proto":"tcp","src_port":44920,"dst_port":8443,"service":"https","classification":"minecraft_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.890162289252049, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022confidence\u0022: 0.42, \u0022classification_confidence\u0022: 0.42, \u0022precision_score\u0022: 50, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0554\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 42.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002203f927aa609ca3d5549749ddb78103ba\u0022, \u0022path_pattern_hash\u0022: \u0022796c509ff0514fcb64ff9e5a1c4b51db\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003F\\u0017\u069b\\\\D\\u0003cn\ufffd\ufffd%\ufffd\ufffdw\\u0004\\\\%y\ufffd\ufffd.\ufffd\ufffd\\t\ufffd|\ufffd\ufffd\ufffd\ufffd] \\u000f\ufffd\ufffdh\\u0014\\u0011?*\\u0011\ufffd\ufffd\\u000474_\\\\i\ufffd\u0026\ufffd\ufffd\ufffd\ufffd a_\ufffd\ufffd\\\u0022\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003F\\u0017\u069b\\\\D\\u0003cn\ufffd\ufffd%\ufffd\ufffdw\\u0004\\\\%y\ufffd\ufffd.\ufffd\ufffd\\t\ufffd|\ufffd\ufffd\ufffd\ufffd] \\u000f\ufffd\ufffdh\\u0014\\u0011?*\\u0011\ufffd\ufffd\\u000474_\\\\i\ufffd\u0026\ufffd\ufffd\ufffd\ufffd a_\ufffd\ufffd\\\u0022\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u0017\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003F\\u0017\u069b\\\\D\\u0003cn\ufffd\ufffd%\ufffd\ufffdw\\u0004\\\\%y\ufffd\ufffd.\ufffd\ufffd\\t\ufffd|\ufffd\ufffd\ufffd\ufffd] \\u000f\ufffd\ufffdh\\u0014\\u0011?*\\u0011\ufffd\ufffd\\u000474_\\\\i\ufffd\u0026\ufffd\ufffd\ufffd\ufffd a_\ufffd\ufffd\\\u0022\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022game_server_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002222c01748218191b8a53a279db6ac15e3dd64515c\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003F\\u0017\u069b\\\\D\\u0003cn\ufffd\ufffd%\ufffd\ufffdw\\u0004\\\\%y\ufffd\ufffd.\ufffd\ufffd\\t\ufffd|\ufffd\ufffd\ufffd\ufffd] \\u000f\ufffd\ufffdh\\u0014\\u0011?*\\u0011\ufffd\ufffd\\u000474_\\\\i\ufffd\u0026\ufffd\ufffd\ufffd\ufffd a_\ufffd\ufffd\\\u0022\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdF\u069b\\\\Dcn\ufffd\ufffd%\ufffd\ufffdw\\\\%y\ufffd\ufffd.\ufffd\ufffd\\t\ufffd|\ufffd\ufffd\ufffd\ufffd] \ufffd\ufffdh?*\ufffd\ufffd74_\\\\i\ufffd\u0026\ufffd\ufffd\ufffd\ufffd a_\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 42, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003F\\u0017\u069b\\\\D\\u0003cn\ufffd\ufffd%\ufffd\ufffdw\\u0004\\\\%y\ufffd\ufffd.\ufffd\ufffd\\t\ufffd|\ufffd\ufffd\ufffd\ufffd] \\u000f\ufffd\ufffdh\\u0014\\u0011?*\\u0011\ufffd\ufffd\\u000474_\\\\i\ufffd\u0026\ufffd\ufffd\ufffd\ufffd a_\ufffd\ufffd\\\u0022\ufffd\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdF\u069b\\\\Dcn\ufffd\ufffd%\ufffd\ufffdw\\\\%y\ufffd\ufffd.\ufffd\ufffd\\t\ufffd|\ufffd\ufffd\ufffd\ufffd] \ufffd\ufffdh?*\ufffd\ufffd74_\\\\i\ufffd\u0026\ufffd\ufffd\ufffd\ufffd a_\ufffd\ufffd\\\u0022\ufffd\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 42 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true, \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 84}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":517},{"id":4503990,"ip":"104.155.55.96","ts":"2026-10-19 04:47:16.000000","proto":"tcp","src_port":44884,"dst_port":8443,"service":"https","classification":"mozi_pattern","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 98, \u0022payload_entropy\u0022: 5.051112401082369, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 82.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 41, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222aa17a6b515596b20eaea8d57184d62da9f48dfc\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 41}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022ca482acb3c2c149616ecc5a07a078d73\u0022, \u0022path_pattern_hash\u0022: \u0022762d384fab941f6d0c2239f19994f30e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 41}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022mitre_tactics\u0022: [\u0022TA0011\u0022], \u0022mitre\u0022: \u0022TA0011\u0022, \u0022threat_family\u0022: [\u0022botnet\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b4f17e5f9b8dd98f3ce90aa0a5f764277ff78346\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via HTTPS:8443 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 41\/100 (Moyen) \u2014 MITRE TA0011 \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 41}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022attack_stage_label\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022risk_score\u0022: 41, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0011\u0022, \u0022mitre_technique\u0022: \u0022TA0011\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via HTTPS:8443 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022command_and_control\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":98},{"id":4503989,"ip":"104.155.55.96","ts":"2026-10-19 04:47:16.000000","proto":"tcp","src_port":44910,"dst_port":8443,"service":"https","classification":"web_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 102, \u0022payload_entropy\u0022: 5.130929759449747, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 42.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 43, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e6b2cf8ce9f9336bf0fcf7e6fb346b1f13664c68\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.49, \u0022classification_confidence\u0022: 0.49, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0420\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0420\u0022], \u0022matched_patterns\u0022: [\u0022pat-0420\u0022], \u0022matched_pattern_names\u0022: [\u0022HTTP OPTIONS method\u0022], \u0022pattern_ids\u0022: [\u0022pat-0420\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 43}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002292bccd537ed25c3c0f989a91c3cc605b\u0022, \u0022path_pattern_hash\u0022: \u00224154520a4208b3f021f35a6cc1dd98ae\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 43}, \u0022payload_preview\u0022: \u0022OPTIONS \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022request_sample\u0022: \u0022OPTIONS \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022OPTIONS \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022OPTIONS \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022OPTIONS \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f51a05915920b45db1aa7f7aa956ed316c9debb5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022OPTIONS \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022OPTIONS \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 43\/100\u0022, \u0022confidence_pct\u0022: 49, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 42.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 43}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 43, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0420\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0420\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022OPTIONS \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022OPTIONS \/ HTTP\/1.1\\r\\nConnection: close\\r\\nUser-Agent: Mozilla\/5.0 (compatible)\\r\\nHost: 62.3.50.33:8443\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 49 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":102},{"id":4503988,"ip":"104.155.55.96","ts":"2026-10-19 04:47:16.000000","proto":"tcp","src_port":44896,"dst_port":8443,"service":"https","classification":"minecraft_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 92, \u0022payload_entropy\u0022: 4.952727587226987, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022confidence\u0022: 0.42, \u0022classification_confidence\u0022: 0.42, \u0022precision_score\u0022: 50, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0554\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 42.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002266c5e9ece52af37f8791609382520726\u0022, \u0022path_pattern_hash\u0022: \u0022796c509ff0514fcb64ff9e5a1c4b51db\u0022, \u0022ja3\u0022: \u00220936656793efc6870927862aa11c885c\u0022, \u0022ja4\u0022: \u0022982a556121c2525258f0d2003571f45d\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 5, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00220936656793efc6870927862aa11c885c\u0022, \u0022tls_ja3\u0022: \u0022771,47-10-19-57-4,13,,\u0022, \u0022tls_ja4_hash\u0022: \u0022982a556121c2525258f0d2003571f45d\u0022, \u0022tls_ja4\u0022: \u0022t13d0105_3fdba35f04dc_d03502c43d74\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 5, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000W\\u0001\\u0000\\u0000S\\u0003\\u0003j\u0560\u06bf\ufffdp\\u001a\ufffdm\ufffdk\ufffd\u02b8Q\ufffdd\\\u0022\ufffd\ufffd\ufffd\u003E\\\u0022\ufffd\ufffd\ufffd@7\ufffd\ufffd\\u000e\\u0000\\u0000\\n\\u0000\/\\u0000\\n\\u0000\\u0013\\u00009\\u0000\\u0004\\u0001\\u0000\\u0000 \\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0001\\u0001\\u0002\\u0001\\u0003\\u0001\\u0004\\u0001\\u0004\\u0002\\u0004\\u0003\\u0004\\u0007\\u0004\\b\\u0006\\u0001\\u0006\\u0002\\u0006\\u0003\\u0006\\u0007\\u0006\\b\u0022, \u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000W\\u0001\\u0000\\u0000S\\u0003\\u0003j\u0560\u06bf\ufffdp\\u001a\ufffdm\ufffdk\ufffd\u02b8Q\ufffdd\\\u0022\ufffd\ufffd\ufffd\u003E\\\u0022\ufffd\ufffd\ufffd@7\ufffd\ufffd\\u000e\\u0000\\u0000\\n\\u0000\/\\u0000\\n\\u0000\\u0013\\u00009\\u0000\\u0004\\u0001\\u0000\\u0000 \\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0001\\u0001\\u0002\\u0001\\u0003\\u0001\\u0004\\u0001\\u0004\\u0002\\u0004\\u0003\\u0004\\u0007\\u0004\\b\\u0006\\u0001\\u0006\\u0002\\u0006\\u0003\\u0006\\u0007\\u0006\\b\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000W\\u0001\\u0000\\u0000S\\u0003\\u0003j\u0560\u06bf\ufffdp\\u001a\ufffdm\ufffdk\ufffd\u02b8Q\ufffdd\\\u0022\ufffd\ufffd\ufffd\u003E\\\u0022\ufffd\ufffd\ufffd@7\ufffd\ufffd\\u000e\\u0000\\u0000\\n\\u0000\/\\u0000\\n\\u0000\\u0013\\u00009\\u0000\\u0004\\u0001\\u0000\\u0000 \\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0001\\u0001\\u0002\\u0001\\u0003\\u0001\\u0004\\u0001\\u0004\\u0002\\u0004\\u0003\\u0004\\u0007\\u0004\\b\\u0006\\u0001\\u0006\\u0002\\u0006\\u0003\\u0006\\u0007\\u0006\\b\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000W\\u0001\\u0000\\u0000S\\u0003\\u0003j\u0560\u06bf\ufffdp\\u001a\ufffdm\ufffdk\ufffd\u02b8Q\ufffdd\\\u0022\ufffd\ufffd\ufffd\u003E\\\u0022\ufffd\ufffd\ufffd@7\ufffd\ufffd\\u000e\\u0000\\u0000\\n\\u0000\/\\u0000\\n\\u0000\\u0013\\u00009\\u0000\\u0004\\u0001\\u0000\\u0000 \\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0001\\u0001\\u0002\\u0001\\u0003\\u0001\\u0004\\u0001\\u0004\\u0002\\u0004\\u0003\\u0004\\u0007\\u0004\\b\\u0006\\u0001\\u0006\\u0002\\u0006\\u0003\\u0006\\u0007\\u0006\\b\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000W\\u0001\\u0000\\u0000S\\u0003\\u0003j\u0560\u06bf\ufffdp\\u001a\ufffdm\ufffdk\ufffd\u02b8Q\ufffdd\\\u0022\ufffd\ufffd\ufffd\u003E\\\u0022\ufffd\ufffd\ufffd@7\ufffd\ufffd\\u000e\\u0000\\u0000\\n\\u0000\/\\u0000\\n\\u0000\\u0013\\u00009\\u0000\\u0004\\u0001\\u0000\\u0000 \\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0001\\u0001\\u0002\\u0001\\u0003\\u0001\\u0004\\u0001\\u0004\\u0002\\u0004\\u0003\\u0004\\u0007\\u0004\\b\\u0006\\u0001\\u0006\\u0002\\u0006\\u0003\\u0006\\u0007\\u0006\\b\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022game_server_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e3fb047ba6bb3fd2dac266c0104f163004f3d101\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000W\\u0001\\u0000\\u0000S\\u0003\\u0003j\u0560\u06bf\ufffdp\\u001a\ufffdm\ufffdk\ufffd\u02b8Q\ufffdd\\\u0022\ufffd\ufffd\ufffd\u003E\\\u0022\ufffd\ufffd\ufffd@7\ufffd\ufffd\\u000e\\u0000\\u0000\\n\\u0000\/\\u0000\\n\\u0000\\u0013\\u00009\\u0000\\u0004\\u0001\\u0000\\u0000 \\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0001\\u0001\\u0002\\u0001\\u0003\\u0001\\u0004\\u0001\\u0004\\u0002\\u0004\\u0003\\u0004\\u0007\\u0004\\b\\u0006\\u0001\\u0006\\u0002\\u0006\\u0003\\u0006\\u0007\\u0006\\b\u0022, \u0022tls_ja3\u0022: \u00220936656793efc6870927862aa11c885c\u0022, \u0022tls_ja4\u0022: \u0022982a556121c2525258f0d2003571f45d\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022WSj\u0560\u06bf\ufffdp\ufffdm\ufffdk\ufffd\u02b8Q\ufffdd\\\u0022\ufffd\ufffd\ufffd\u003E\\\u0022\ufffd\ufffd\ufffd@7\ufffd\ufffd\\n\/\\n9\u0022, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 42, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000W\\u0001\\u0000\\u0000S\\u0003\\u0003j\u0560\u06bf\ufffdp\\u001a\ufffdm\ufffdk\ufffd\u02b8Q\ufffdd\\\u0022\ufffd\ufffd\ufffd\u003E\\\u0022\ufffd\ufffd\ufffd@7\ufffd\ufffd\\u000e\\u0000\\u0000\\n\\u0000\/\\u0000\\n\\u0000\\u0013\\u00009\\u0000\\u0004\\u0001\\u0000\\u0000 \\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0001\\u0001\\u0002\\u0001\\u0003\\u0001\\u0004\\u0001\\u0004\\u0002\\u0004\\u0003\\u0004\\u0007\\u0004\\b\\u0006\\u0001\\u0006\\u0002\\u0006\\u0003\\u0006\\u0007\\u0006\\b\u0022, \u0022tls_ja3\u0022: \u00220936656793efc6870927862aa11c885c\u0022, \u0022tls_ja4\u0022: \u0022982a556121c2525258f0d2003571f45d\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022WSj\u0560\u06bf\ufffdp\ufffdm\ufffdk\ufffd\u02b8Q\ufffdd\\\u0022\ufffd\ufffd\ufffd\u003E\\\u0022\ufffd\ufffd\ufffd@7\ufffd\ufffd\\n\/\\n9\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 42 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":92},{"id":4503987,"ip":"104.155.55.96","ts":"2026-10-19 04:47:16.000000","proto":"tcp","src_port":44874,"dst_port":8443,"service":"https","classification":"minecraft_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.918644437304524, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022confidence\u0022: 0.42, \u0022classification_confidence\u0022: 0.42, \u0022precision_score\u0022: 50, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0554\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 42.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00220b771418f1e6fcc5f4eacd1193eca39e\u0022, \u0022path_pattern_hash\u0022: \u0022796c509ff0514fcb64ff9e5a1c4b51db\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffdPQ\\u0004V`\ufffdd`\ufffd\ufffd\\u00192\ufffdn\ufffd\ufffd\ufffd\ufffd7\\u0011\ufffd-\ufffdt\ufffd\u0204\ufffd \ufffd\ufffdL\ufffdO\ufffd\ufffdk\ufffd\\u001bx\ufffdb\ufffd\ufffd\u0027\ufffd\ufffd\ufffd\ufffd\\u00122\ufffd\ufffd\ufffdq\ufffdS7.)\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffdPQ\\u0004V`\ufffdd`\ufffd\ufffd\\u00192\ufffdn\ufffd\ufffd\ufffd\ufffd7\\u0011\ufffd-\ufffdt\ufffd\u0204\ufffd \ufffd\ufffdL\ufffdO\ufffd\ufffdk\ufffd\\u001bx\ufffdb\ufffd\ufffd\u0027\ufffd\ufffd\ufffd\ufffd\\u00122\ufffd\ufffd\ufffdq\ufffdS7.)\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u0017\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffdPQ\\u0004V`\ufffdd`\ufffd\ufffd\\u00192\ufffdn\ufffd\ufffd\ufffd\ufffd7\\u0011\ufffd-\ufffdt\ufffd\u0204\ufffd \ufffd\ufffdL\ufffdO\ufffd\ufffdk\ufffd\\u001bx\ufffdb\ufffd\ufffd\u0027\ufffd\ufffd\ufffd\ufffd\\u00122\ufffd\ufffd\ufffdq\ufffdS7.)\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022game_server_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e0e6b67011c27be1c7db0bd2710503c3fb5329ba\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffdPQ\\u0004V`\ufffdd`\ufffd\ufffd\\u00192\ufffdn\ufffd\ufffd\ufffd\ufffd7\\u0011\ufffd-\ufffdt\ufffd\u0204\ufffd \ufffd\ufffdL\ufffdO\ufffd\ufffdk\ufffd\\u001bx\ufffdb\ufffd\ufffd\u0027\ufffd\ufffd\ufffd\ufffd\\u00122\ufffd\ufffd\ufffdq\ufffdS7.)\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffdPQV`\ufffdd`\ufffd\ufffd2\ufffdn\ufffd\ufffd\ufffd\ufffd7\ufffd-\ufffdt\ufffd\u0204\ufffd \ufffd\ufffdL\ufffdO\ufffd\ufffdk\ufffdx\ufffdb\ufffd\ufffd\u0027\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffdq\ufffdS7.)\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 42, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffdPQ\\u0004V`\ufffdd`\ufffd\ufffd\\u00192\ufffdn\ufffd\ufffd\ufffd\ufffd7\\u0011\ufffd-\ufffdt\ufffd\u0204\ufffd \ufffd\ufffdL\ufffdO\ufffd\ufffdk\ufffd\\u001bx\ufffdb\ufffd\ufffd\u0027\ufffd\ufffd\ufffd\ufffd\\u00122\ufffd\ufffd\ufffdq\ufffdS7.)\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffdPQV`\ufffdd`\ufffd\ufffd2\ufffdn\ufffd\ufffd\ufffd\ufffd7\ufffd-\ufffdt\ufffd\u0204\ufffd \ufffd\ufffdL\ufffdO\ufffd\ufffdk\ufffdx\ufffdb\ufffd\ufffd\u0027\ufffd\ufffd\ufffd\ufffd2\ufffd\ufffd\ufffdq\ufffdS7.)\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 42 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":517},{"id":4503986,"ip":"104.155.55.96","ts":"2026-10-19 04:47:16.000000","proto":"tcp","src_port":44868,"dst_port":8443,"service":"https","classification":"minecraft_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.935354320478707, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022confidence\u0022: 0.42, \u0022classification_confidence\u0022: 0.42, \u0022precision_score\u0022: 50, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0554\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 42.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022934861bbbcec1f9379f372336f1d0340\u0022, \u0022path_pattern_hash\u0022: \u0022796c509ff0514fcb64ff9e5a1c4b51db\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003b\ufffdM\\u0011\ufffd\ufffd\u074c)\ufffd\u003C\ufffdr\ufffd\\u0006epw\ufffd\u0026t\ufffd\u010e\u0285\ufffd+\ufffd\ufffd\ufffdy \ufffd\ufffd32\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffdIWs\ufffdV\ufffd\ufffdX[\\u0005\ufffd\ufffd\ufffd=\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003b\ufffdM\\u0011\ufffd\ufffd\u074c)\ufffd\u003C\ufffdr\ufffd\\u0006epw\ufffd\u0026t\ufffd\u010e\u0285\ufffd+\ufffd\ufffd\ufffdy \ufffd\ufffd32\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffdIWs\ufffdV\ufffd\ufffdX[\\u0005\ufffd\ufffd\ufffd=\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u0017\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003b\ufffdM\\u0011\ufffd\ufffd\u074c)\ufffd\u003C\ufffdr\ufffd\\u0006epw\ufffd\u0026t\ufffd\u010e\u0285\ufffd+\ufffd\ufffd\ufffdy \ufffd\ufffd32\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffdIWs\ufffdV\ufffd\ufffdX[\\u0005\ufffd\ufffd\ufffd=\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022game_server_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002219138e93dc1b1655028f49947929d87af44f1703\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003b\ufffdM\\u0011\ufffd\ufffd\u074c)\ufffd\u003C\ufffdr\ufffd\\u0006epw\ufffd\u0026t\ufffd\u010e\u0285\ufffd+\ufffd\ufffd\ufffdy \ufffd\ufffd32\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffdIWs\ufffdV\ufffd\ufffdX[\\u0005\ufffd\ufffd\ufffd=\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdb\ufffdM\ufffd\ufffd\u074c)\ufffd\u003C\ufffdr\ufffdepw\ufffd\u0026t\ufffd\u010e\u0285\ufffd+\ufffd\ufffd\ufffdy \ufffd\ufffd32\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffdIWs\ufffdV\ufffd\ufffdX[\ufffd\ufffd\ufffd=\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 42, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003b\ufffdM\\u0011\ufffd\ufffd\u074c)\ufffd\u003C\ufffdr\ufffd\\u0006epw\ufffd\u0026t\ufffd\u010e\u0285\ufffd+\ufffd\ufffd\ufffdy \ufffd\ufffd32\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffdIWs\ufffdV\ufffd\ufffdX[\\u0005\ufffd\ufffd\ufffd=\ufffd\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdb\ufffdM\ufffd\ufffd\u074c)\ufffd\u003C\ufffdr\ufffdepw\ufffd\u0026t\ufffd\u010e\u0285\ufffd+\ufffd\ufffd\ufffdy \ufffd\ufffd32\ufffd\ufffdp\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffdIWs\ufffdV\ufffd\ufffdX[\ufffd\ufffd\ufffd=\ufffd\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 42 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":517},{"id":4503985,"ip":"104.155.55.96","ts":"2026-10-19 04:47:16.000000","proto":"tcp","src_port":44866,"dst_port":8443,"service":"https","classification":"minecraft_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.8678117296481975, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Google LLC\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 396982, \u0022country\u0022: \u0022BE\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022841a7de3c3cbd932ffe2df923d0bb6a948309046\u0022, \u0022event_fingerprint\u0022: \u002248aa5a12dd4150e072f6d3dd03f9143ac67f8d69\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022confidence\u0022: 0.42, \u0022classification_confidence\u0022: 0.42, \u0022precision_score\u0022: 50, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0554\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 42.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022BE\u0022, \u0022asn\u0022: 396982, \u0022org\u0022: \u0022Google LLC\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022f215d481f3a93bb5aac71f6519240018\u0022, \u0022path_pattern_hash\u0022: \u0022796c509ff0514fcb64ff9e5a1c4b51db\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003x,RW\\u0005\\u0010\ufffd\u003E\ufffd`D\ufffd\ufffd\ufffd\\u0012\ufffd\\u000e=\ufffd\\u0019\ufffdc4f\ufffd\ufffd\\u0012y 7\ufffd7 \ufffdy;\ufffd\ufffd\ufffd\ufffd\ufffd3\ufffdk\ufffdP]\u040c\ufffdW \ufffd\ufffd:\ufffdx7\\u0006\\u0001IA\\u0015\ufffd1\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003x,RW\\u0005\\u0010\ufffd\u003E\ufffd`D\ufffd\ufffd\ufffd\\u0012\ufffd\\u000e=\ufffd\\u0019\ufffdc4f\ufffd\ufffd\\u0012y 7\ufffd7 \ufffdy;\ufffd\ufffd\ufffd\ufffd\ufffd3\ufffdk\ufffdP]\u040c\ufffdW \ufffd\ufffd:\ufffdx7\\u0006\\u0001IA\\u0015\ufffd1\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd`\ufffdV\ufffdR\ufffd$\ufffd(\\u0000k\\u0000j\ufffds\ufffdw\\u0000\ufffd\\u0000\ufffd\ufffd#\ufffd\u0027\\u0000g\\u0000@\ufffdr\ufffdv\\u0000\ufffd\\u0000\ufffd\ufffd\\n\ufffd\\u0014\\u00008\\u0000\ufffd\\u0000\ufffd\ufffd\\t\ufffd\\u0013\\u00002\\u0000\ufffd\\u0000\ufffd\\u0000E\\u0000D\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdQ\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdP\\u0000=\\u0000\ufffd\\u0000\u003C\\u0000\ufffd\\u0000\ufffd\\u0000\ufffd\\u0000A\\u0000\ufffd\\u0001\\u0000\\u0001\\u0017\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003x,RW\\u0005\\u0010\ufffd\u003E\ufffd`D\ufffd\ufffd\ufffd\\u0012\ufffd\\u000e=\ufffd\\u0019\ufffdc4f\ufffd\ufffd\\u0012y 7\ufffd7 \ufffdy;\ufffd\ufffd\ufffd\ufffd\ufffd3\ufffdk\ufffdP]\u040c\ufffdW \ufffd\ufffd:\ufffdx7\\u0006\\u0001IA\\u0015\ufffd1\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022game_server_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222d43ef86f7f5f53747c70aa35791dec8b812556b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003x,RW\\u0005\\u0010\ufffd\u003E\ufffd`D\ufffd\ufffd\ufffd\\u0012\ufffd\\u000e=\ufffd\\u0019\ufffdc4f\ufffd\ufffd\\u0012y 7\ufffd7 \ufffdy;\ufffd\ufffd\ufffd\ufffd\ufffd3\ufffdk\ufffdP]\u040c\ufffdW \ufffd\ufffd:\ufffdx7\\u0006\\u0001IA\\u0015\ufffd1\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdx,RW\ufffd\u003E\ufffd`D\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffdc4f\ufffd\ufffdy 7\ufffd7 \ufffdy;\ufffd\ufffd\ufffd\ufffd\ufffd3\ufffdk\ufffdP]\u040c\ufffdW \ufffd\ufffd:\ufffdx7IA\ufffd1\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 42, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003x,RW\\u0005\\u0010\ufffd\u003E\ufffd`D\ufffd\ufffd\ufffd\\u0012\ufffd\\u000e=\ufffd\\u0019\ufffdc4f\ufffd\ufffd\\u0012y 7\ufffd7 \ufffdy;\ufffd\ufffd\ufffd\ufffd\ufffd3\ufffdk\ufffdP]\u040c\ufffdW \ufffd\ufffd:\ufffdx7\\u0006\\u0001IA\\u0015\ufffd1\\u0000\ufffd\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\\u00003\\u00009\\u00005\\u0000\/\ufffd,\ufffd0\\u0000\ufffd\\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\\u0000\ufffd\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:8443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdx,RW\ufffd\u003E\ufffd`D\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffdc4f\ufffd\ufffdy 7\ufffd7 \ufffdy;\ufffd\ufffd\ufffd\ufffd\ufffd3\ufffdk\ufffdP]\u040c\ufffdW \ufffd\ufffd:\ufffdx7IA\ufffd1\ufffd395\/\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd+\ufffd\/\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 42 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":517}],"total_events":22}