{"ip":"109.94.96.211","exported_at":"2026-07-31T18:45:24+00:00","period_days":30,"metrics":{"events7d":7,"distinct_ports":1,"distinct_classifications":5,"max_severity":10,"last_sensor_id":"paris-1","max_waf_score":29,"max_risk_score":65,"attack_stage":"probe","attack_chain_stage":"discovery","threat_family":["scanner"],"recommended_action":"monitor","confidence":0.58,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":43,"novelty":0},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":4,"executive_one_liner_fr":"Activit\u00e9 suspecte \u00b7 risque 35\/100","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":43,"novelty":0,"risk_score":35,"correlation_boost":8},"persona_hostname":"mail.sensor-1.internal","correlation_flags":["multi_protocol_correlation"],"correlation_flags_labels_fr":["Multi-protocole corr\u00e9l\u00e9 (5 min)"],"confidence_pct":58,"confidence_hint_fr":"Corr\u00e9lation +8","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0554"],"tags_summary":["pat-0554"],"attack_vector":"tls probe \u00b7 via TLS:5173 \u00b7 (sonde \/ probe)","protocol_details":{"payload_preview":"\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00034\ufffd\u074e0\ufffd\u000b\u0016\ufffd\u0211\ufffd-M\ufffdLct\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdD\ufffd\b\ufffd\ufffd\u000e\ufffd \ufffd*\ufffd\ufffd1\u001c\ufffd\ufffd\ufffd\ufffd?}\u0013\ufffdrj\ufffdD\ufffdvh\ufffdE\ufffd\u0011\ufffdN@\ufffd\ufffd\ufffdi\u0000\u003E\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd\u0027\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd","tls_ja3":"755cbaaa441626ab9e759e8982278df5","port":5173,"service":"tls","service_label_fr":"TLS"},"protocol_summary_fr":"JA3 755cbaaa441626ab \u00b7 Payload \u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00034\ufffd\u074e0\ufffd\u000b\u0016\ufffd\u0211\ufffd-M\ufffdLct\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdD\ufffd\b\ufffd\ufffd\u000e\ufffd \ufffd*\ufffd\ufffd1\u001c\ufffd\ufffd\ufffd\ufffd?}\u0013\ufffdrj\ufffdD\ufffdvh\u2026 \u00b7 TLS:5173","evidence_snippet":"\ufffd4\ufffd\u074e0\ufffd\ufffd\u0211\ufffd-M\ufffdLct\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd \ufffd*\ufffd\ufffd1\ufffd\ufffd\ufffd\ufffd?}\ufffdrj\ufffdD\ufffdvh\ufffdE\ufffd\ufffdN@\ufffd\ufffd\ufffdi\u003E\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd\u0027g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd","target_port_label":"5173 \u00b7 TLS","emulator_service":"tls","confidence_reason":"Confiance 50 % \u2014 Motif catalogue confirm\u00e9","classification_reason":"Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","classification_reason_label_fr":"Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_factors_fr":"Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8","payload_preview":"\ufffd4\ufffd\u074e0\ufffd\ufffd\u0211\ufffd-M\ufffdLct\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd \ufffd*\ufffd\ufffd1\ufffd\ufffd\ufffd\ufffd?}\ufffdrj\ufffdD\ufffdvh\ufffdE\ufffd\ufffdN@\ufffd\ufffd\ufffdi\u003E\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd\u0027g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd"},"events":[{"id":14151382,"ip":"109.94.96.211","ts":"2026-07-28 20:43:45.000000","proto":"tcp","src_port":29898,"dst_port":5173,"service":"http","classification":"dependency_confusion_probe","waf_score":6,"waf_tags":"[\u0022950468:nosqli-3\u0022]","http_method":"GET","http_target":"\/@vite\/env","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u0022506ddeaa328a30ee430e4945a9e449c8f1fd5e13\u0022, \u0022http_host_hash\u0022: \u00224c81e67ae174ff2630ae6942fb4c99c7689f04ec\u0022, \u0022http_target_hash\u0022: \u002240b9f1f37d5bd759c353e90078138580f67eb091\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 135, \u0022payload_entropy\u0022: 5.132319724351551, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Latitude.sh\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396356, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 5173, \u0022risk_waf\u0022: 32.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 31, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022053dcd8245d2a7327946e7a1479644a0105b8452\u0022, \u0022event_fingerprint\u0022: \u00226a21dd06602958c0c7d733bb417b42ee2c150bb1\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 31}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 396356, \u0022org\u0022: \u0022Latitude.sh\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002217631b715e46fe0600bc7c6416a9eb6f\u0022, \u0022payload_hash\u0022: \u00223d9eb3bc3eaceb1d8bb74e1a173cd4e0\u0022, \u0022path_pattern_hash\u0022: \u00224dc97305677d2ce6ca5089c1a325a933\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 5173, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 31}, \u0022payload_preview\u0022: \u0022GET \/@vite\/env HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, defl\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/@vite\/env\u0022, \u0022user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/@vite\/env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/@vite\/env HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/@vite\/env HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, defl\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/@vite\/env\u0022, \u0022user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/@vite\/env HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/@vite\/env HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/@vite\/env HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, defl\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022supply_chain\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f9a5276c4ad4b969724d7f3f51c8738e183fb8a4\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/@vite\/env\u0022, \u0022request_line\u0022: \u0022GET \/@vite\/env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022port\u0022: 5173, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/@vite\/env HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, defl\u0022, \u0022attack_vector\u0022: \u0022dependency confusion probe \u00b7 via HTTP:5173 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/@vite\/env\u0022, \u0022target_port_label\u0022: \u00225173 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 31\/100 (Faible) \u2014 MITRE TA0001 \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 31}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 31, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 5173, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/@vite\/env\u0022, \u0022request_line\u0022: \u0022GET \/@vite\/env HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022port\u0022: 5173, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022dependency confusion probe \u00b7 via HTTP:5173 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/@vite\/env\u0022, \u0022evidence_snippet\u0022: \u0022GET \/@vite\/env HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, defl\u0022, \u0022target_port_label\u0022: \u00225173 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225173\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022http_dependency_confusion_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:5173","http_user_agent":"CryptoHunter-Vite-2026\/1.0","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022http_dependency_confusion_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":135},{"id":14151383,"ip":"109.94.96.211","ts":"2026-07-28 20:43:45.000000","proto":"tcp","src_port":29894,"dst_port":5173,"service":"http","classification":"probe_node_modules","waf_score":6,"waf_tags":"[\u0022950468:nosqli-3\u0022]","http_method":"GET","http_target":"\/node_modules\/.vite\/deps\/nope-1156dc2e.js.map","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 4, \u0022http_path_ext\u0022: \u0022map\u0022, \u0022http_ua_hash\u0022: \u0022506ddeaa328a30ee430e4945a9e449c8f1fd5e13\u0022, \u0022http_host_hash\u0022: \u00224c81e67ae174ff2630ae6942fb4c99c7689f04ec\u0022, \u0022http_target_hash\u0022: \u0022b8c6e3d12046716b5ae394aad56613733f2d0c83\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 170, \u0022payload_entropy\u0022: 5.161019208161795, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Latitude.sh\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396356, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 5173, \u0022risk_waf\u0022: 32.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229925d24629304300497b13b2b21ea059068c9f17\u0022, \u0022event_fingerprint\u0022: \u00226855e8b0a40a24195b9a5a91ff35bf600f795760\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 396356, \u0022org\u0022: \u0022Latitude.sh\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002217631b715e46fe0600bc7c6416a9eb6f\u0022, \u0022payload_hash\u0022: \u00227430cbea42d065510e0171702bc531a6\u0022, \u0022path_pattern_hash\u0022: \u002275736e650773c625234cebc53c71d994\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 5173, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 24}, \u0022payload_preview\u0022: \u0022GET \/node_modules\/.vite\/deps\/nope-1156dc2e.js.map HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/node_modules\/.vite\/deps\/nope-1156dc2e.js.map\u0022, \u0022user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/node_modules\/.vite\/deps\/nope-1156dc2e.js.map HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/node_modules\/.vite\/deps\/nope-1156dc2e.js.map HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/node_modules\/.vite\/deps\/nope-1156dc2e.js.map HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/node_modules\/.vite\/deps\/nope-1156dc2e.js.map\u0022, \u0022user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/node_modules\/.vite\/deps\/nope-1156dc2e.js.map HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/node_modules\/.vite\/deps\/nope-1156dc2e.js.map HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/node_modules\/.vite\/deps\/nope-1156dc2e.js.map HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f4cf73fae4d4696569150088118d262fce7d11e6\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/node_modules\/.vite\/deps\/nope-1156dc2e.js.map\u0022, \u0022request_line\u0022: \u0022GET \/node_modules\/.vite\/deps\/nope-1156dc2e.js.map HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022port\u0022: 5173, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/node_modules\/.vite\/deps\/nope-1156dc2e.js.map HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022probe node modules \u00b7 via HTTP:5173 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/node_modules\/.vite\/deps\/nope-1156dc2e.js.map\u0022, \u0022target_port_label\u0022: \u00225173 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 5173, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/node_modules\/.vite\/deps\/nope-1156dc2e.js.map\u0022, \u0022request_line\u0022: \u0022GET \/node_modules\/.vite\/deps\/nope-1156dc2e.js.map HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022port\u0022: 5173, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022probe node modules \u00b7 via HTTP:5173 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/node_modules\/.vite\/deps\/nope-1156dc2e.js.map\u0022, \u0022evidence_snippet\u0022: \u0022GET \/node_modules\/.vite\/deps\/nope-1156dc2e.js.map HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00225173 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225173\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022http_probe_node_modules\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:5173","http_user_agent":"CryptoHunter-Vite-2026\/1.0","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022http_probe_node_modules\u0022]","anomalies":"[]","severity":4,"bytes_in":170},{"id":14151384,"ip":"109.94.96.211","ts":"2026-07-28 20:43:45.000000","proto":"tcp","src_port":29886,"dst_port":5173,"service":"http","classification":"probe_node_modules","waf_score":6,"waf_tags":"[\u0022950468:nosqli-3\u0022]","http_method":"GET","http_target":"\/node_modules\/.vite\/deps\/_metadata.json","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 4, \u0022http_path_ext\u0022: \u0022json\u0022, \u0022http_ua_hash\u0022: \u0022506ddeaa328a30ee430e4945a9e449c8f1fd5e13\u0022, \u0022http_host_hash\u0022: \u00224c81e67ae174ff2630ae6942fb4c99c7689f04ec\u0022, \u0022http_target_hash\u0022: \u00229a52af308f1a3f6b62386a91e7a59c76dbb01057\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 164, \u0022payload_entropy\u0022: 5.172274157431619, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Latitude.sh\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396356, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 5173, \u0022risk_waf\u0022: 32.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 24, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229925d24629304300497b13b2b21ea059068c9f17\u0022, \u0022event_fingerprint\u0022: \u002291ba0ea1c2f8b718664d4ab983ac31a4af17d373\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 396356, \u0022org\u0022: \u0022Latitude.sh\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002217631b715e46fe0600bc7c6416a9eb6f\u0022, \u0022payload_hash\u0022: \u0022f490f55938da54a3a310ed9949468b89\u0022, \u0022path_pattern_hash\u0022: \u0022ce5f27605df383fe4d0192799bee41bc\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 5173, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 24}, \u0022payload_preview\u0022: \u0022GET \/node_modules\/.vite\/deps\/_metadata.json HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/node_modules\/.vite\/deps\/_metadata.json\u0022, \u0022user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/node_modules\/.vite\/deps\/_metadata.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/node_modules\/.vite\/deps\/_metadata.json HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/node_modules\/.vite\/deps\/_metadata.json HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/node_modules\/.vite\/deps\/_metadata.json\u0022, \u0022user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/node_modules\/.vite\/deps\/_metadata.json HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/node_modules\/.vite\/deps\/_metadata.json HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/node_modules\/.vite\/deps\/_metadata.json HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022595707983dc2afca8c92c5300048eaf6089fd8bd\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/node_modules\/.vite\/deps\/_metadata.json\u0022, \u0022request_line\u0022: \u0022GET \/node_modules\/.vite\/deps\/_metadata.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022port\u0022: 5173, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/node_modules\/.vite\/deps\/_metadata.json HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\u0022, \u0022attack_vector\u0022: \u0022probe node modules \u00b7 via HTTP:5173 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/node_modules\/.vite\/deps\/_metadata.json\u0022, \u0022target_port_label\u0022: \u00225173 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 24}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 24, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 5173, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/node_modules\/.vite\/deps\/_metadata.json\u0022, \u0022request_line\u0022: \u0022GET \/node_modules\/.vite\/deps\/_metadata.json HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022port\u0022: 5173, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022probe node modules \u00b7 via HTTP:5173 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/node_modules\/.vite\/deps\/_metadata.json\u0022, \u0022evidence_snippet\u0022: \u0022GET \/node_modules\/.vite\/deps\/_metadata.json HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\u0022, \u0022target_port_label\u0022: \u00225173 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225173\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022http_probe_node_modules\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:5173","http_user_agent":"CryptoHunter-Vite-2026\/1.0","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022http_probe_node_modules\u0022]","anomalies":"[]","severity":4,"bytes_in":164},{"id":14151385,"ip":"109.94.96.211","ts":"2026-07-28 20:43:45.000000","proto":"tcp","src_port":29902,"dst_port":5173,"service":"http","classification":"lfi_path_traversal","waf_score":29,"waf_tags":"[\u0022950264:lfi-1\u0022, \u0022950316:lfi-14\u0022, \u0022950325:rce-0\u0022, \u0022950468:nosqli-3\u0022]","http_method":"GET","http_target":"\/@fs\/etc\/passwd?import\u0026raw","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 2, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u0022506ddeaa328a30ee430e4945a9e449c8f1fd5e13\u0022, \u0022http_host_hash\u0022: \u00224c81e67ae174ff2630ae6942fb4c99c7689f04ec\u0022, \u0022http_target_hash\u0022: \u00227d7e9261291dd4b99f15868c317377bb7684b961\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 151, \u0022payload_entropy\u0022: 5.228956876060524, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Latitude.sh\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396356, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 5173, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 78.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 6.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 65, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022dc0890def394f549b0db12791398e0a0676280c4\u0022, \u0022event_fingerprint\u0022: \u0022dcfc9b47dcbee6e6326e90ef5b71e43478523f49\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 344, \u0022precision_signals\u0022: [\u0022MITRE-T1083\u0022, \u0022pat-0716\u0022, \u0022pat-0137\u0022, \u0022CRS-930100-sub\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1083\u0022, \u0022pat-0716\u0022, \u0022pat-0137\u0022, \u0022CRS-930100-sub\u0022], \u0022matched_patterns\u0022: [\u0022pat-0716\u0022, \u0022pat-0137\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 930160 etc passwd\u0022, \u0022LFI path \/etc\/passwd\u0022], \u0022pattern_ids\u0022: [\u0022pat-0716\u0022, \u0022pat-0137\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 65}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022path_traversal\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 396356, \u0022org\u0022: \u0022Latitude.sh\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002217631b715e46fe0600bc7c6416a9eb6f\u0022, \u0022payload_hash\u0022: \u00220d774a2fb86790178b926dfaf7f4abb3\u0022, \u0022path_pattern_hash\u0022: \u00229ebee12be2f011123396c267e699472d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 5173, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 65}, \u0022payload_preview\u0022: \u0022GET \/@fs\/etc\/passwd?import\u0026raw HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Enco\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/@fs\/etc\/passwd\u0022, \u0022query_string\u0022: \u0022import\u0026raw\u0022, \u0022user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950264:lfi-1\u0022, \u0022950316:lfi-14\u0022, \u0022950325:rce-0\u0022, \u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-1\u0022, \u0022lfi-14\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/@fs\/etc\/passwd?import\u0026raw HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/@fs\/etc\/passwd?import\u0026raw HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/@fs\/etc\/passwd?import\u0026raw HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Enco\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/@fs\/etc\/passwd\u0022, \u0022query_string\u0022: \u0022import\u0026raw\u0022, \u0022user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950264:lfi-1\u0022, \u0022950316:lfi-14\u0022, \u0022950325:rce-0\u0022, \u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-1\u0022, \u0022lfi-14\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/@fs\/etc\/passwd?import\u0026raw HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/@fs\/etc\/passwd?import\u0026raw HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/@fs\/etc\/passwd?import\u0026raw HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Enco\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002262af81b5edc84db64969ef231614853d16de7121\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/@fs\/etc\/passwd\u0022, \u0022request_line\u0022: \u0022GET \/@fs\/etc\/passwd?import\u0026raw HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022port\u0022: 5173, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/@fs\/etc\/passwd?import\u0026raw HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Enco\u0022, \u0022attack_vector\u0022: \u0022lfi path traversal \u00b7 via HTTP:5173 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/@fs\/etc\/passwd\u0022, \u0022target_port_label\u0022: \u00225173 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 65}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 65, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 5173, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1083\u0022, \u0022pat-0716\u0022, \u0022pat-0137\u0022, \u0022CRS-930100-sub\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1083\u0022, \u0022pat-0716\u0022, \u0022pat-0137\u0022, \u0022CRS-930100-sub\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/@fs\/etc\/passwd\u0022, \u0022request_line\u0022: \u0022GET \/@fs\/etc\/passwd?import\u0026raw HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022port\u0022: 5173, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022lfi path traversal \u00b7 via HTTP:5173 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/@fs\/etc\/passwd\u0022, \u0022evidence_snippet\u0022: \u0022GET \/@fs\/etc\/passwd?import\u0026raw HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Enco\u0022, \u0022target_port_label\u0022: \u00225173 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225173\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950264:lfi-1\u0022, \u0022950316:lfi-14\u0022, \u0022950325:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022http_dependency_confusion_probe\u0022, \u0022http_sensitive_path\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:5173","http_user_agent":"CryptoHunter-Vite-2026\/1.0","http_referer":null,"tags":"[\u0022950264:lfi-1\u0022, \u0022950316:lfi-14\u0022, \u0022950325:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022http_dependency_confusion_probe\u0022, \u0022http_sensitive_path\u0022]","anomalies":"[]","severity":10,"bytes_in":151},{"id":14151386,"ip":"109.94.96.211","ts":"2026-07-28 20:43:45.000000","proto":"tcp","src_port":29918,"dst_port":5173,"service":"tls","classification":"tls_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022tls_ja3_hash\u0022: \u0022755cbaaa441626ab9e759e8982278df5\u0022, \u0022tls_sni\u0022: null, \u0022tls_weak_cipher\u0022: true, \u0022tls_weak_cipher_count\u0022: 8, \u0022tls_alpn\u0022: [\u0022http\/1.1\u0022], \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.121194988137092, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Latitude.sh\u0022, \u0022service\u0022: \u0022tls\u0022, \u0022app_proto\u0022: \u0022tls\u0022, \u0022asn\u0022: 396356, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 5173, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 6, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022cde1f17a91118436f2db9a3ef53b4022a39ac11c\u0022, \u0022event_fingerprint\u0022: \u0022410a6a28116a280ae64a7fe8402b213dbfedf18b\u0022, \u0022classification_confidence\u0022: 0.58, \u0022confidence\u0022: 0.58, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 396356, \u0022org\u0022: \u0022Latitude.sh\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022ja3\u0022: \u0022755cbaaa441626ab9e759e8982278df5\u0022, \u0022payload_hash\u0022: \u0022848bfab8130d6f1b75b0ddd51cb4b515\u0022, \u0022path_pattern_hash\u0022: \u00228792d2cfdc5028123bfb8f159de8656c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 5173, \u0022service\u0022: \u0022tls\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022risk_score\u0022: 35}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u00034\ufffd\u074e0\ufffd\\u000b\\u0016\ufffd\u0211\ufffd-M\ufffdLct\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdD\ufffd\\b\ufffd\ufffd\\u000e\ufffd \ufffd*\ufffd\ufffd1\\u001c\ufffd\ufffd\ufffd\ufffd?}\\u0013\ufffdrj\ufffdD\ufffdvh\ufffdE\ufffd\\u0011\ufffdN@\ufffd\ufffd\ufffdi\\u0000\u003E\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\\u0000\ufffd\ufffd$\ufffd(\\u0000k\ufffd#\ufffd\u0027\\u0000g\ufffd\\n\ufffd\\u0014\\u00009\ufffd\\t\ufffd\\u0013\\u00003\\u0000\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u00034\ufffd\u074e0\ufffd\\u000b\\u0016\ufffd\u0211\ufffd-M\ufffdLct\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdD\ufffd\\b\ufffd\ufffd\\u000e\ufffd \ufffd*\ufffd\ufffd1\\u001c\ufffd\ufffd\ufffd\ufffd?}\\u0013\ufffdrj\ufffdD\ufffdvh\ufffdE\ufffd\\u0011\ufffdN@\ufffd\ufffd\ufffdi\\u0000\u003E\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\\u0000\ufffd\ufffd$\ufffd(\\u0000k\ufffd#\ufffd\u0027\\u0000g\ufffd\\n\ufffd\\u0014\\u00009\ufffd\\t\ufffd\\u0013\\u00003\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\\u0001u\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\u0016\\u0000\\u0014\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u0018\\u0001\\u0000\\u0001\\u0001\\u0001\\u0002\\u0001\\u0003\\u0001\\u0004\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\r\\u0000*\\u0000(\\u0004\\u0003\\u0005\\u0003\\u0006\\u0003\\b\\u0007\\b\\b\\b\\t\\b\\n\\b\\u000b\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0003\\u0003\\u0003\\u0001\\u0003\\u0002\\u0004\\u0002\\u0005\\u0002\\u0006\\u0002\\u0000+\\u0000\\u0005\\u0004\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u00034\ufffd\u074e0\ufffd\\u000b\\u0016\ufffd\u0211\ufffd-M\ufffdLct\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdD\ufffd\\b\ufffd\ufffd\\u000e\ufffd \ufffd*\ufffd\ufffd1\\u001c\ufffd\ufffd\ufffd\ufffd?}\\u0013\ufffdrj\ufffdD\ufffdvh\ufffdE\ufffd\\u0011\ufffdN@\ufffd\ufffd\ufffdi\\u0000\u003E\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\\u0000\ufffd\ufffd$\ufffd(\\u0000k\ufffd#\ufffd\u0027\\u0000g\ufffd\\n\ufffd\\u0014\\u00009\ufffd\\t\ufffd\\u0013\\u00003\\u0000\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222001754885e4126bb7fdec84d21f8ddca98a0678\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u00034\ufffd\u074e0\ufffd\\u000b\\u0016\ufffd\u0211\ufffd-M\ufffdLct\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdD\ufffd\\b\ufffd\ufffd\\u000e\ufffd \ufffd*\ufffd\ufffd1\\u001c\ufffd\ufffd\ufffd\ufffd?}\\u0013\ufffdrj\ufffdD\ufffdvh\ufffdE\ufffd\\u0011\ufffdN@\ufffd\ufffd\ufffdi\\u0000\u003E\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\\u0000\ufffd\ufffd$\ufffd(\\u0000k\ufffd#\ufffd\u0027\\u0000g\ufffd\\n\ufffd\\u0014\\u00009\ufffd\\t\ufffd\\u0013\\u00003\\u0000\ufffd\u0022, \u0022tls_ja3\u0022: \u0022755cbaaa441626ab9e759e8982278df5\u0022, \u0022port\u0022: 5173, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd4\ufffd\u074e0\ufffd\ufffd\u0211\ufffd-M\ufffdLct\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd \ufffd*\ufffd\ufffd1\ufffd\ufffd\ufffd\ufffd?}\ufffdrj\ufffdD\ufffdvh\ufffdE\ufffd\ufffdN@\ufffd\ufffd\ufffdi\u003E\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd\u0027g\ufffd\\n\ufffd9\ufffd\\t\ufffd3\ufffd\u0022, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5173 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00225173 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022, \u0022dst_port\u0022: 5173, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-tls\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u00034\ufffd\u074e0\ufffd\\u000b\\u0016\ufffd\u0211\ufffd-M\ufffdLct\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdD\ufffd\\b\ufffd\ufffd\\u000e\ufffd \ufffd*\ufffd\ufffd1\\u001c\ufffd\ufffd\ufffd\ufffd?}\\u0013\ufffdrj\ufffdD\ufffdvh\ufffdE\ufffd\\u0011\ufffdN@\ufffd\ufffd\ufffdi\\u0000\u003E\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\\u0000\ufffd\ufffd$\ufffd(\\u0000k\ufffd#\ufffd\u0027\\u0000g\ufffd\\n\ufffd\\u0014\\u00009\ufffd\\t\ufffd\\u0013\\u00003\\u0000\ufffd\u0022, \u0022tls_ja3\u0022: \u0022755cbaaa441626ab9e759e8982278df5\u0022, \u0022port\u0022: 5173, \u0022service\u0022: \u0022tls\u0022, \u0022service_label_fr\u0022: \u0022TLS\u0022}, \u0022attack_vector\u0022: \u0022tls probe \u00b7 via TLS:5173 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd4\ufffd\u074e0\ufffd\ufffd\u0211\ufffd-M\ufffdLct\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffd \ufffd*\ufffd\ufffd1\ufffd\ufffd\ufffd\ufffd?}\ufffdrj\ufffdD\ufffdvh\ufffdE\ufffd\ufffdN@\ufffd\ufffd\ufffdi\u003E\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd\u0027g\ufffd\\n\ufffd9\ufffd\\t\ufffd3\ufffd\u0022, \u0022target_port_label\u0022: \u00225173 \u00b7 TLS\u0022, \u0022emulator_service\u0022: \u0022tls\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022tls\u0022, \u0022service_banner\u0022: \u0022honeypot-tls\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225173\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022tls\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]}","tls_sni":null,"tls_ja3_hash":"755cbaaa441626ab9e759e8982278df5","tls_ja3":"771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2","http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022tls_ja3\u0022, \u0022tls_no_sni\u0022, \u0022tls_weak_cipher\u0022]","anomalies":"[]","severity":4,"bytes_in":517},{"id":14151380,"ip":"109.94.96.211","ts":"2026-07-28 20:43:44.000000","proto":"tcp","src_port":29870,"dst_port":5173,"service":"http","classification":"dependency_confusion_probe","waf_score":6,"waf_tags":"[\u0022950468:nosqli-3\u0022]","http_method":"GET","http_target":"\/@vite\/client","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u0022506ddeaa328a30ee430e4945a9e449c8f1fd5e13\u0022, \u0022http_host_hash\u0022: \u00224c81e67ae174ff2630ae6942fb4c99c7689f04ec\u0022, \u0022http_target_hash\u0022: \u0022833db7a464c37ab7229060f08e60a06af29f5dee\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 138, \u0022payload_entropy\u0022: 5.117896386092493, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Latitude.sh\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396356, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 5173, \u0022risk_waf\u0022: 32.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 31, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022053dcd8245d2a7327946e7a1479644a0105b8452\u0022, \u0022event_fingerprint\u0022: \u0022d46233915eedbfbc69e0ed041f1ce887f17adb70\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 31}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 396356, \u0022org\u0022: \u0022Latitude.sh\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002217631b715e46fe0600bc7c6416a9eb6f\u0022, \u0022payload_hash\u0022: \u0022da58dda9f16f4079957bbb01930bff16\u0022, \u0022path_pattern_hash\u0022: \u0022c68849e37368064fbce5270e5170cc80\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 5173, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 31}, \u0022payload_preview\u0022: \u0022GET \/@vite\/client HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, d\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/@vite\/client\u0022, \u0022user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/@vite\/client HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/@vite\/client HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/@vite\/client HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, d\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/@vite\/client\u0022, \u0022user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950468:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/@vite\/client HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/@vite\/client HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/@vite\/client HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, d\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022supply_chain\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002291415721f5f5f68ed70246ff3724cc1b8f3103d8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/@vite\/client\u0022, \u0022request_line\u0022: \u0022GET \/@vite\/client HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022port\u0022: 5173, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/@vite\/client HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, d\u0022, \u0022attack_vector\u0022: \u0022dependency confusion probe \u00b7 via HTTP:5173 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/@vite\/client\u0022, \u0022target_port_label\u0022: \u00225173 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: nosqli-3 \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 31\/100 (Faible) \u2014 MITRE TA0001 \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 32.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 31}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 31, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 5173, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/@vite\/client\u0022, \u0022request_line\u0022: \u0022GET \/@vite\/client HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022port\u0022: 5173, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022dependency confusion probe \u00b7 via HTTP:5173 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/@vite\/client\u0022, \u0022evidence_snippet\u0022: \u0022GET \/@vite\/client HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, d\u0022, \u0022target_port_label\u0022: \u00225173 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225173\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950468:nosqli-3\u0022, \u0022http_dependency_confusion_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:5173","http_user_agent":"CryptoHunter-Vite-2026\/1.0","http_referer":null,"tags":"[\u0022950468:nosqli-3\u0022, \u0022http_dependency_confusion_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":138},{"id":14151381,"ip":"109.94.96.211","ts":"2026-07-28 20:43:44.000000","proto":"tcp","src_port":29866,"dst_port":5173,"service":"http","classification":"http","waf_score":3,"waf_tags":"[\u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u0022506ddeaa328a30ee430e4945a9e449c8f1fd5e13\u0022, \u0022http_host_hash\u0022: \u00224c81e67ae174ff2630ae6942fb4c99c7689f04ec\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 126, \u0022payload_entropy\u0022: 5.101931166310721, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Latitude.sh\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 396356, \u0022country\u0022: \u0022DE\u0022, \u0022dst_port\u0022: 5173, \u0022risk_waf\u0022: 20.0, \u0022risk_classification\u0022: 8.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 25.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 8.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022eb313ddd39dbe862a4893793476cf80113d93810\u0022, \u0022event_fingerprint\u0022: \u0022ff06c28332643488489c8de3b87b418f83030673\u0022, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022DE\u0022, \u0022asn\u0022: 396356, \u0022org\u0022: \u0022Latitude.sh\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002217631b715e46fe0600bc7c6416a9eb6f\u0022, \u0022payload_hash\u0022: \u002221b2ea2feefb8385f7210f01a297b69a\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022service_name\u0022: \u0022http\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 5173, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022waf_tags\u0022: [\u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%\u0022}, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 8.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022confidence\u0022: 0.58, \u0022classification_confidence\u0022: 0.58, \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e69fefd3178c64bd9770650b331acc0daea1fe13\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022port\u0022: 5173, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate\u0022, \u0022attack_vector\u0022: \u0022http \u00b7 via HTTP:5173 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00225173 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 58%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 8.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 5173, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022CryptoHunter-Vite-2026\/1.0\u0022, \u0022port\u0022: 5173, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http \u00b7 via HTTP:5173 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:5173\\r\\nUser-Agent: CryptoHunter-Vite-2026\/1.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate\u0022, \u0022target_port_label\u0022: \u00225173 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225173\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950734:sap-sapcontrol-path\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:5173","http_user_agent":"CryptoHunter-Vite-2026\/1.0","http_referer":null,"tags":"[\u0022950734:sap-sapcontrol-path\u0022]","anomalies":"[]","severity":1,"bytes_in":126}],"total_events":7}