15/06/2026 05:07:07 UTC
TCP
4605 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:4605 · (tentative d'exploit)
Élevée
Moyen · 46
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit/553.45 (…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
4605
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 46
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit/553.45 (KHTML, like Gecko) Chrome/100.0.1076 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:4605
User-Agent: Mozilla/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit/553.45 (KHTML, like Ge
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:4605 User-Agent: Mozilla/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit/553.45 (KHTML, like Gecko) Chrome/100.0.1076 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "a00ffb71a6eec295514c64d01cb945c9caa24226",
"http_host_hash": "fd887b5a5cb441d5546ead7da166e7c891effc89",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 210,
"payload_entropy": 5.403610895718478,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 4605,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "0427ca42b1406be07ebb5b70a7eeed890a43a702",
"event_fingerprint": "c0acd36332eae3d26f3e1c0ad6a68dc78c95ff2d",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6cbe7ae671988d4e40644d7b4d9f076d",
"payload_hash": "1380ead40b0a7a7f0abdcf98c1acf851",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 4605,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4605\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/553.45 (KHTML, like Ge",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/553.45 (KHTML, like Gecko) Chrome\/100.0.1076 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4605\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/553.45 (KHTML, like Gecko) Chrome\/100.0.1076 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4605\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/553.45 (KHTML, like Ge",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/553.45 (KHTML, like Gecko) Chrome\/100.0.1076 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4605\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/553.45 (KHTML, like Gecko) Chrome\/100.0.1076 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4605\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/553.45 (KHTML, like Ge",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "34287c0c3c3229cdad3fb7d6b63d695c6fcf7430",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/553.45 (KHTML, like Gecko) Chrome\/100.0.1076 Safari\/537.36",
"port": 4605,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4605\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/553.45 (KHTML, like Ge",
"attack_vector": "exploit attempt \u00b7 via HTTP:4605 \u00b7 (tentative d'exploit)",
"target_port_label": "4605 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4605,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/553.45 (KHTML, like Gecko) Chrome\/100.0.1076 Safari\/537.36",
"port": 4605,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:4605 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4605\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1_2; Win64; x64) AppleWebKit\/553.45 (KHTML, like Ge",
"target_port_label": "4605 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4605"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
15/06/2026 05:07:07 UTC
TCP
4605 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:4605 · (sonde / probe) · → /favicon.ico
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /favicon.ico UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
4605
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:4605
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "fd887b5a5cb441d5546ead7da166e7c891effc89",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.938795003120691,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 4605,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "9c5a482fccf7314a43381fcf445b9913329dc271",
"event_fingerprint": "1d01cd59b811babb0e928a97f007718573044964",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "eb848607b0bb04d50ee7d194968cff93",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 4605,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:4605\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:4605\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:4605\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:4605\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:4605\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5b3b028ba01e4ced710d754c3ca36d79096dfb34",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 4605,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:4605\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:4605 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"target_port_label": "4605 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4605,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate favicon.ico",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 4605,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:4605 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:4605\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "4605 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4605"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
15/06/2026 00:57:50 UTC
TCP
4569 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:4569 · (sonde / probe) · → /favicon.ico
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /favicon.ico UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
4569
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:4569
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "4825b4999fd26ee19c1d4723a0717cc1bd03f644",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.954668018993708,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 4569,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "a8d3c291a4a084d02a590d996a4316da34f1da06",
"event_fingerprint": "d973d1740be3a201bfa01a8074634c3cec8391cc",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "4966b3867c4f1c4eae0bd6bb8a06f855",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 4569,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "39f28660c1eb6881d57a262aa796b1e0f5a5a3c2",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 4569,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:4569 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"target_port_label": "4569 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4569,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate favicon.ico",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 4569,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:4569 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "4569 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4569"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
15/06/2026 00:57:50 UTC
TCP
4569 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:4569 · (sonde / probe) · → /robots.txt
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /robots.txt UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
4569
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête robots.txt
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:4569
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "4825b4999fd26ee19c1d4723a0717cc1bd03f644",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 4.939276337346147,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 4569,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "a8d3c291a4a084d02a590d996a4316da34f1da06",
"event_fingerprint": "24903ddb88cdaab87e01fd8c746872fbb275e8a0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "aeb9a9a792cbe448fa53808cc6d12712",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 4569,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "633b201bb3f830499697ffc5e545b1c2df6117f5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 4569,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:4569 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"target_port_label": "4569 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4569,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate robots.txt",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 4569,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:4569 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "4569 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4569"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
15/06/2026 00:57:50 UTC
TCP
4569 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:4569 · (sonde / probe) · → /sitemap.xml
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /sitemap.xml UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
4569
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête sitemap.xml
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:4569
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "4825b4999fd26ee19c1d4723a0717cc1bd03f644",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.99826930925818,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 4569,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "a8d3c291a4a084d02a590d996a4316da34f1da06",
"event_fingerprint": "eadc3e86bf147cfeb59a21f64311d11041b8c0b6",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 92,
"precision_signals": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "0136b39dbda6e9050b2143c26ff64b85",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 4569,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "19cb9563d3bb111706d75101bcabad50d1d52de4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 4569,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:4569 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"target_port_label": "4569 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4569,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate sitemap.xml",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 4569,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:4569 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "4569 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4569"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
15/06/2026 00:57:49 UTC
TCP
4569 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:4569 · (tentative d'exploit)
Élevée
Moyen · 45
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Windows NT 7_0_2; Win64; x64) AppleWebKit/575.46 (…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
4569
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 45
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 7_0_2; Win64; x64) AppleWebKit/575.46 (KHTML, like Gecko) Chrome/105.0.244 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:4569
User-Agent: Mozilla/5.0 (Windows NT 7_0_2; Win64; x64) AppleWebKit/575.46 (KHTML, like Ge
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:4569 User-Agent: Mozilla/5.0 (Windows NT 7_0_2; Win64; x64) AppleWebKit/575.46 (KHTML, like Gecko) Chrome/105.0.244 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "7c83c33943f4ad594948c14836416c35942afedc",
"http_host_hash": "4825b4999fd26ee19c1d4723a0717cc1bd03f644",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 209,
"payload_entropy": 5.413310858705148,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 4569,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "aa59664d6888edc08105bd4061c21faa5b43ed6c",
"event_fingerprint": "d7ff5b8fb27dbe2b47ad73f2cf481270c82665cb",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 45
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "788226c58e653fe82244a60e0dcccc97",
"payload_hash": "14d09139b87046f5dc6cca8911a0ac6c",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 4569,
"service": "http",
"service_name": "http",
"risk_score": 45
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_2; Win64; x64) AppleWebKit\/575.46 (KHTML, like Ge",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 7_0_2; Win64; x64) AppleWebKit\/575.46 (KHTML, like Gecko) Chrome\/105.0.244 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_2; Win64; x64) AppleWebKit\/575.46 (KHTML, like Gecko) Chrome\/105.0.244 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_2; Win64; x64) AppleWebKit\/575.46 (KHTML, like Ge",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 7_0_2; Win64; x64) AppleWebKit\/575.46 (KHTML, like Gecko) Chrome\/105.0.244 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_2; Win64; x64) AppleWebKit\/575.46 (KHTML, like Gecko) Chrome\/105.0.244 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_2; Win64; x64) AppleWebKit\/575.46 (KHTML, like Ge",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "60c91ed876283f0a3a97ad010b460f9045789401",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 7_0_2; Win64; x64) AppleWebKit\/575.46 (KHTML, like Gecko) Chrome\/105.0.244 Safari\/537.36",
"port": 4569,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_2; Win64; x64) AppleWebKit\/575.46 (KHTML, like Ge",
"attack_vector": "exploit attempt \u00b7 via HTTP:4569 \u00b7 (tentative d'exploit)",
"target_port_label": "4569 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 45
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 45,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4569,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 7_0_2; Win64; x64) AppleWebKit\/575.46 (KHTML, like Gecko) Chrome\/105.0.244 Safari\/537.36",
"port": 4569,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:4569 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4569\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_2; Win64; x64) AppleWebKit\/575.46 (KHTML, like Ge",
"target_port_label": "4569 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4569"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
08/06/2026 02:52:38 UTC
TCP
146 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:146 · (sonde / probe) · → /favicon.ico
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /favicon.ico UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
146
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:146
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "eef0beae9c9bd7eb7f351d9ab0074186f9015873",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 4.9141143611243345,
"port_category": "well_known",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 146,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "f9314bb32d7554257e677f940a56e85a1b61df48",
"event_fingerprint": "30c26fd95db13cb2972c5f80828c88ba47765e05",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "eee15698d5494a04dee64ff4f2f70203",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 146,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6ae08c31a13e86312603f69a730b84b74f95485b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 146,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:146 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"target_port_label": "146 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 146,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate favicon.ico",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 146,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:146 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "146 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "146"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
08/06/2026 02:52:38 UTC
TCP
146 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:146 · (sonde / probe) · → /robots.txt
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /robots.txt UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
146
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête robots.txt
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:146
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "eef0beae9c9bd7eb7f351d9ab0074186f9015873",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 124,
"payload_entropy": 4.898364585476153,
"port_category": "well_known",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 146,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "f9314bb32d7554257e677f940a56e85a1b61df48",
"event_fingerprint": "f29d6eac52e4967529dc3568f6b21d51994769ae",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "f8947488f17dd5b58e627f53528e2097",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 146,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "20544f0f644b560f765f5ad51884186ef8a4904c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 146,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:146 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"target_port_label": "146 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 146,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate robots.txt",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 146,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:146 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "146 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "146"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
08/06/2026 02:52:38 UTC
TCP
146 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:146 · (sonde / probe) · → /sitemap.xml
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /sitemap.xml UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
146
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête sitemap.xml
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:146
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "eef0beae9c9bd7eb7f351d9ab0074186f9015873",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 4.958064461710921,
"port_category": "well_known",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 146,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.9,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "f9314bb32d7554257e677f940a56e85a1b61df48",
"event_fingerprint": "c7193015b9ca106a22b7ce8d577f16204ab95766",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 92,
"precision_signals": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "ab92a88d26dd67b1e82aa5fdbf2f89ea",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 146,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dabf9f14ed4ad8df6fd28a96d2a0e28763bd58a3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 146,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:146 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"target_port_label": "146 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 146,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate sitemap.xml",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 146,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:146 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "146 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "146"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
08/06/2026 02:52:37 UTC
TCP
146 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:146 · (tentative d'exploit)
Élevée
Moyen · 47
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit/562.5…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
146
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 47
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit/562.53 (KHTML, like Gecko) Chrome/94.0.2032 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:146
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit/562.53 (KHTML, like
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:146 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit/562.53 (KHTML, like Gecko) Chrome/94.0.2032 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "5d30dcba10077a5b153eeebef229739de0c59d3b",
"http_host_hash": "eef0beae9c9bd7eb7f351d9ab0074186f9015873",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 211,
"payload_entropy": 5.394221327619753,
"port_category": "well_known",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 146,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c1410c69427d5214d0c32a23bbdef9e48529f5ea",
"event_fingerprint": "a2aac692ce087e9f0d13d68372c08aed6ea8490d",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6b616a6d9ebc0f08fe2ed44d3fe72d31",
"payload_hash": "161bf9c838ca9e806983797c03c3dcb5",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 146,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/562.53 (KHTML, like ",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/562.53 (KHTML, like Gecko) Chrome\/94.0.2032 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/562.53 (KHTML, like Gecko) Chrome\/94.0.2032 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/562.53 (KHTML, like",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/562.53 (KHTML, like Gecko) Chrome\/94.0.2032 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/562.53 (KHTML, like Gecko) Chrome\/94.0.2032 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/562.53 (KHTML, like",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2e529fdfd4a628800f7054cfd25d38eed3a25cdf",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/562.53 (KHTML, like Gecko) Chrome\/94.0.2032 Safari\/537.36",
"port": 146,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/562.53 (KHTML, like",
"attack_vector": "exploit attempt \u00b7 via HTTP:146 \u00b7 (tentative d'exploit)",
"target_port_label": "146 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 47
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 47,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 146,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/562.53 (KHTML, like Gecko) Chrome\/94.0.2032 Safari\/537.36",
"port": 146,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:146 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:146\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_1) AppleWebKit\/562.53 (KHTML, like",
"target_port_label": "146 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "146"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
07/06/2026 20:35:44 UTC
TCP
2203 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:2203 · (sonde / probe) · → /favicon.ico
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /favicon.ico UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2203
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:2203
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "e2d001e007944ce9fc03a8b1165cf557adb89347",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.9070489713746595,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 2203,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.7,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "ddb580e479c7201236d2c33471fd935b88a27fcf",
"event_fingerprint": "79b0aac8b58930ec03e4388da0ba67e95badb148",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "5f1302b9d6690164ae0e3d941944f0b3",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 2203,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "451ae35b383a85217b1c776b4a9c3e5e7f69b881",
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 2203,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2203 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"target_port_label": "2203 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2203,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate favicon.ico",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/favicon.ico",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 2203,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2203 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/favicon.ico",
"evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "2203 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2203"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 20:35:44 UTC
TCP
2203 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:2203 · (sonde / probe) · → /robots.txt
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /robots.txt UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2203
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête robots.txt
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:2203
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "e2d001e007944ce9fc03a8b1165cf557adb89347",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 4.891276337346147,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 2203,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.7,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "ddb580e479c7201236d2c33471fd935b88a27fcf",
"event_fingerprint": "bcdd2b5d763ff3ebd5f7da6b66e7084071184c6d",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 94,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "3b202d94ca40b5c4c22419b74170eaca",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 2203,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5d8d653359138ba3dc94e077378dbea7d4e4e947",
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 2203,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2203 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"target_port_label": "2203 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2203,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate robots.txt",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/robots.txt",
"request_line": "GET \/robots.txt HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 2203,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2203 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/robots.txt",
"evidence_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "2203 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2203"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 20:35:44 UTC
TCP
2203 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:2203 · (sonde / probe) · → /sitemap.xml
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
Protocole
GET /sitemap.xml UA Go-http-client/1.1
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2203
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Confiance : Confiance 95 % — Motif catalogue confirmé
Signaux
Requête sitemap.xml
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:2203
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "e2d001e007944ce9fc03a8b1165cf557adb89347",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.950650261639131,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 2203,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 0.7,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "ddb580e479c7201236d2c33471fd935b88a27fcf",
"event_fingerprint": "94c3359805712060e74ddb99d638ca8bd11aa72f",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 92,
"precision_signals": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "76a8c76b45cdcd0a471ec59af1498717",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 2203,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "751c282523368f1c40b91d5e7b92ae92deaa5492",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 2203,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2203 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"target_port_label": "2203 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2203,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate sitemap.xml",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sitemap.xml",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"http_user_agent": "Go-http-client\/1.1",
"port": 2203,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:2203 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/sitemap.xml",
"evidence_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"target_port_label": "2203 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2203"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
07/06/2026 20:35:43 UTC
TCP
2203 · HTTP
Tentative d'exploit
exploit attempt · via HTTP:2203 · (tentative d'exploit)
Élevée
Moyen · 43
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 8_1_1) AppleWebKit/565.5…
Émulateur
HTTP
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2203
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 43
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 8_1_1) AppleWebKit/565.55 (KHTML, like Gecko) Chrome/73.0.2860 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2203
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 8_1_1) AppleWebKit/565.55 (KHTML, like
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2203 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 8_1_1) AppleWebKit/565.55 (KHTML, like Gecko) Chrome/73.0.2860 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "74312395a99112705739076022c8839f221785b6",
"http_host_hash": "e2d001e007944ce9fc03a8b1165cf557adb89347",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 212,
"payload_entropy": 5.3646512438584075,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 2203,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 43,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "fa89d773ddd4b15c4b795775c51c4772bfdfa112",
"event_fingerprint": "5371453d622f84203f2c7d25bb7bc5e80395818a",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 43
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "67eb4e914a69ca2e87897b3263413764",
"payload_hash": "f917483480459cdfcd81d17819e6843a",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2203,
"service": "http",
"service_name": "http",
"risk_score": 43
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_1_1) AppleWebKit\/565.55 (KHTML, like",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_1_1) AppleWebKit\/565.55 (KHTML, like Gecko) Chrome\/73.0.2860 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_1_1) AppleWebKit\/565.55 (KHTML, like Gecko) Chrome\/73.0.2860 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_1_1) AppleWebKit\/565.55 (KHTML, like",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_1_1) AppleWebKit\/565.55 (KHTML, like Gecko) Chrome\/73.0.2860 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_1_1) AppleWebKit\/565.55 (KHTML, like Gecko) Chrome\/73.0.2860 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_1_1) AppleWebKit\/565.55 (KHTML, like",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fc56203b9fbbfac29b68613efa05362f232293d1",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_1_1) AppleWebKit\/565.55 (KHTML, like Gecko) Chrome\/73.0.2860 Safari\/537.36",
"port": 2203,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_1_1) AppleWebKit\/565.55 (KHTML, like",
"attack_vector": "exploit attempt \u00b7 via HTTP:2203 \u00b7 (tentative d'exploit)",
"target_port_label": "2203 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 62 % \u2014 via HTTP",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 43
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 43,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2203,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_1_1) AppleWebKit\/565.55 (KHTML, like Gecko) Chrome\/73.0.2860 Safari\/537.36",
"port": 2203,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "exploit attempt \u00b7 via HTTP:2203 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2203\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_1_1) AppleWebKit\/565.55 (KHTML, like",
"target_port_label": "2203 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF",
"confidence_factors_fr": "Confiance 62 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2203"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
07/06/2026 11:43:09 UTC
TCP
4671 · HTTP
Sonde HTTP
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
4671
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Signaux
Requête favicon.ico
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:4671
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "7459789a25002e1980bf2349b4a3f804311d1814",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.941893094593416,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 4671,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "36f7425dba1f82e5a19dc109c8132c4f0a67a982",
"event_fingerprint": "0e42ca53a66283400c681a340bc231198334f073",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 102,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "0856316a0f8e810049c5c4e215f7d6b6",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 4671,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "adc485d974d14c5e1e5eb4d5f503278426d5d147",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4671,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate favicon.ico",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4671"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 11:43:09 UTC
TCP
4671 · HTTP
Sonde HTTP
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
4671
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Signaux
Requête robots.txt
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:4671
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "7459789a25002e1980bf2349b4a3f804311d1814",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 4.926399213550654,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 4671,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "36f7425dba1f82e5a19dc109c8132c4f0a67a982",
"event_fingerprint": "1eb4ebb6f396f7643709a2ed0c0aace90470edcb",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 102,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "5d7c283f7eef437c7e65de739b973c4b",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 4671,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "57e8b791b95a49f16ea29f73a1c7ad1cbde4169a",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4671,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate robots.txt",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4671"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 11:43:09 UTC
TCP
4671 · HTTP
Sonde HTTP
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1595
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
4671
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 40
Signaux
Requête sitemap.xml
Single Port
Chemin bénin connu
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:4671
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "7459789a25002e1980bf2349b4a3f804311d1814",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.985494384857888,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 4671,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "36f7425dba1f82e5a19dc109c8132c4f0a67a982",
"event_fingerprint": "b5f7aaeaf528040e90ce5742c94d861bad47eb65",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 100,
"precision_signals": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "a4f3fe778f661f5fab7beb5844cc8f8b",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 4671,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"mitre": "T1595",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8c848ca5ce621e0b4e04939d115519b56956a3f9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4671,
"protocol_emulated": null,
"tags_summary": [
"INT-benign-sitemap",
"INT-single-port",
"INT-benign-path-cap"
],
"tags_summary_labels_fr": [
"Requ\u00eate sitemap.xml",
"Single Port",
"Chemin b\u00e9nin connu"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1595",
"mitre_technique": "T1595",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4671"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 11:43:08 UTC
TCP
4671 · HTTP
Tentative d'exploit
Élevée
Moyen · 46
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
4671
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 46
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 9_2_2) AppleWebKit/559.50 (KHTML, like Gecko) Chrome/88.0.2824 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:4671
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 9_2_2) AppleWebKit/559.50 (KHTML, like
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:4671 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 9_2_2) AppleWebKit/559.50 (KHTML, like Gecko) Chrome/88.0.2824 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "59ffbef2b002ca6a63c5cde3573a0378e44062b1",
"http_host_hash": "7459789a25002e1980bf2349b4a3f804311d1814",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 212,
"payload_entropy": 5.42087242746007,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 4671,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "1d21d05a82a8e07786be6adcd8b323851e10703a",
"event_fingerprint": "89494eb96290da3b3207cfb04ff3066576a98231",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "18a560f7e8e4595df751fda5ddfbd24f",
"payload_hash": "5e68a4405cadad54eb6ea39b61f70dc6",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 4671,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2_2) AppleWebKit\/559.50 (KHTML, like",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2_2) AppleWebKit\/559.50 (KHTML, like Gecko) Chrome\/88.0.2824 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2_2) AppleWebKit\/559.50 (KHTML, like Gecko) Chrome\/88.0.2824 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2_2) AppleWebKit\/559.50 (KHTML, like",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2_2) AppleWebKit\/559.50 (KHTML, like Gecko) Chrome\/88.0.2824 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2_2) AppleWebKit\/559.50 (KHTML, like Gecko) Chrome\/88.0.2824 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:4671\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_2_2) AppleWebKit\/559.50 (KHTML, like",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1a17791928d8ce0f761537c23573a8ab47b612b6",
"site_display": {
"classification": null,
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence_pct": 62,
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4671,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1190"
],
"tags_summary_labels_fr": [
"MITRE-T1190"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4671"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
07/06/2026 06:01:53 UTC
TCP
10564 · HTTP
Sonde HTTP
Moyenne
Faible · 35
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10564
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 34%
Confiance classification
34%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:10564
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "5fc008c17671b7b0a878684e8af956971aae39a8",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 127,
"payload_entropy": 4.9810864358359765,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 10564,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 35,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "0b3f78d4d55ea1d5e633e19551242bdb0f39be86",
"event_fingerprint": "4385f2cba22c5863d2e32ab3762fbb25dfa9d1e0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 34%",
"confidence": 0.34,
"classification_confidence": 0.34,
"precision_score": 40,
"precision_signals": [
"INT-single-port"
],
"kb_rule_ids": [
"INT-single-port"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 35
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 34,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "2bfa731b5f476dc8ee98055e6722a3db",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 10564,
"service": "http",
"service_name": "http",
"risk_score": 35
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 34%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7fdd0f62934e138c08d561561b73dd6a72e0b062",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10564"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 06:01:53 UTC
TCP
10564 · HTTP
Sonde HTTP
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
MITRE
T1595
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10564
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:10564
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "5fc008c17671b7b0a878684e8af956971aae39a8",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.922334416444921,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 10564,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "0b3f78d4d55ea1d5e633e19551242bdb0f39be86",
"event_fingerprint": "f3562b26d9d4291f45ade171411a03a94cce8976",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 102,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "ee7feb85f93f98b6542d5d29cdf17c63",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 10564,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2be5c44b89b25e473690f4d8542bc2e6cf08a6f6",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10564"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
07/06/2026 06:01:52 UTC
TCP
10564 · HTTP
Tentative d'exploit
Élevée
Moyen · 47
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10564
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit/558.36 (KHTML, like Gecko) Chrome/102.0.2950 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:10564
User-Agent: Mozilla/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit/558.36 (KHTML, like Gec
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:10564 User-Agent: Mozilla/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit/558.36 (KHTML, like Gecko) Chrome/102.0.2950 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "45aadac4afbc38938df211d99a3a379394085041",
"http_host_hash": "5fc008c17671b7b0a878684e8af956971aae39a8",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 209,
"payload_entropy": 5.417400585845212,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 10564,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "f30d271bdee149b22ae364bb6673d404513fcd10",
"event_fingerprint": "b39867f1837427c1b58a34fcb6368d87dc563167",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"confidence_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15,
"risk_score": 47
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c105af4b06edd7ccf7a7c022a48a2f8b",
"payload_hash": "4b3869cf2f2fd3786864180d887698ff",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 10564,
"service": "http",
"service_name": "http",
"risk_score": 47
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/558.36 (KHTML, like Gec",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/558.36 (KHTML, like Gecko) Chrome\/102.0.2950 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/558.36 (KHTML, like Gecko) Chrome\/102.0.2950 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/558.36 (KHTML, like Gec",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/558.36 (KHTML, like Gecko) Chrome\/102.0.2950 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/558.36 (KHTML, like Gecko) Chrome\/102.0.2950 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/558.36 (KHTML, like Gec",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eba10813a4451ab60503c627b513d2a20b45f156",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10564"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploit_attempt",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
07/06/2026 06:01:52 UTC
TCP
10564 · HTTP
Sonde HTTP
Moyenne
Moyen · 40
Détails
Voir
Étape
Sonde / probe
MITRE
T1595
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
10564
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:10564
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "5fc008c17671b7b0a878684e8af956971aae39a8",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 127,
"payload_entropy": 4.937828462817683,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 10564,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "0b3f78d4d55ea1d5e633e19551242bdb0f39be86",
"event_fingerprint": "fac4d9562c164b35430bac72e83a4cfdb7e329d9",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 102,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "2b1253f4d6a365cd49ba910a3a436e99",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 10564,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:10564\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre_techniques": [
"T1595"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "418c8236b51b9fe577db378cdfc4f5cd66275136",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "10564"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
06/06/2026 21:14:30 UTC
TCP
2342
—
Sonde port
Faible
Faible · 17
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
2342
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
t3 12.1.2
AS:2048
HL:19
Meta JSON brut
{
"bytes_in": 25,
"payload_entropy": 3.7834651896016456,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": null,
"app_proto": null,
"asn": 135377,
"country": "TH",
"dst_port": 2342,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 17,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "ac5a83afc3bba0f77e8e05da4818b7d945e9ff5f",
"event_fingerprint": "2b6efbd9817980828206d4119429c0c18942038f",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 17
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "588580493dbf1d2ca7cd7f2cd09ed672",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 2342
},
"payload_preview": "t3 12.1.2\nAS:2048\nHL:19\n\n",
"request_sample": "t3 12.1.2\nAS:2048\nHL:19\n\n",
"payload_snippet": "t3 12.1.2\nAS:2048\nHL:19",
"evidence": {
"request_sample": "t3 12.1.2\nAS:2048\nHL:19\n\n",
"payload_snippet": "t3 12.1.2\nAS:2048\nHL:19",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "41695fbac500f43d430c54f20ae46da23240e8f1",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "2342"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
06/06/2026 21:14:29 UTC
TCP
2342 · TLS
dnp3 probe
Élevée
Faible · 28
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
2342
Chemin / cible
—
Pourquoi cette classification : Type « dnp3_probe » (signaux protocolaires) · confiance 51%
Confiance classification
51%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
Sigma DNP3 link
PostgreSQL startup
STUN binding
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �{iJD��P���� �`�Qc�Xd?��ɝż/� n3 �d��O?C�% lK�����~> q�Hƍ�= &�+�/�,�0̨̩� ��
� � � / 5�
�
Requête brute (extrait)
� �{iJD��P���� �`�Qc�Xd?��ɝż/� n3 �d��O?C�% lK�����~> q�Hƍ�= &�+�/�,�0̨̩� �� � � � / 5� � + 3 & $ �=%d#�JL���e^�W?M�]�n�� �
Meta JSON brut
{
"tls_ja3_hash": "9460af62ae0af667130bf0d36514f084",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 247,
"payload_entropy": 5.780473261635833,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "tls",
"app_proto": "tls",
"asn": 135377,
"country": "TH",
"dst_port": 2342,
"risk_waf": 8,
"risk_classification": 58,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 28,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "2b7512a0d2a4392cfab858247d5ec699edb9fd8f",
"event_fingerprint": "dcdb3d25a5c6c2946eb64fa6957e5de438850c90",
"classification_reason": "Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%",
"confidence": 0.51,
"classification_confidence": 0.51,
"precision_score": 60,
"precision_signals": [
"pat-0794"
],
"kb_rule_ids": [
"pat-0794"
],
"matched_patterns": [
"pat-0794",
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"Sigma DNP3 link",
"PostgreSQL startup",
"STUN binding",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0794",
"pat-0369",
"pat-0771",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"confidence_breakdown": {
"waf": 8,
"classification": 58,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 28
},
"named_classification_skipped": false,
"service_name": "tls",
"risk_confidence_factor": 51,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "9460af62ae0af667130bf0d36514f084",
"payload_hash": "f0569ae0f7477a55fde0c56be5153912",
"path_pattern_hash": "859b07b9d78548343d57aca7faf5fc6a",
"ja4": "9d78dfefabcee3ee16297d72e4cafc86"
},
"target_context": {
"dst_port": 2342,
"service": "tls",
"service_name": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003{iJ\u0005D\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u001c\ufffd`\ufffdQ\u001bc\ufffdXd?\ufffd\ufffd\u025d\u017c\/\ufffd n3\t\ufffdd\ufffd\ufffdO?C\ufffd\u0018% lK\ufffd\ufffd\ufffd\ufffd\ufffd~>\tq\ufffdH\u018d\ufffd=\u0000\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003{iJ\u0005D\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u001c\ufffd`\ufffdQ\u001bc\ufffdXd?\ufffd\ufffd\u025d\u017c\/\ufffd n3\t\ufffdd\ufffd\ufffdO?C\ufffd\u0018% lK\ufffd\ufffd\ufffd\ufffd\ufffd~>\tq\ufffdH\u018d\ufffd=\u0000\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0005\ufffd=%d#\ufffdJL\ufffd\ufffd\ufffde^\ufffdW?\u0014M\ufffd]\ufffdn\ufffd\ufffd\u0002\r\ufffd\u000f",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003{iJ\u0005D\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u001c\ufffd`\ufffdQ\u001bc\ufffdXd?\ufffd\ufffd\u025d\u017c\/\ufffd n3\t\ufffdd\ufffd\ufffdO?C\ufffd\u0018% lK\ufffd\ufffd\ufffd\ufffd\ufffd~>\tq\ufffdH\u018d\ufffd=\u0000\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003{iJ\u0005D\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u001c\ufffd`\ufffdQ\u001bc\ufffdXd?\ufffd\ufffd\u025d\u017c\/\ufffd n3\t\ufffdd\ufffd\ufffdO?C\ufffd\u0018% lK\ufffd\ufffd\ufffd\ufffd\ufffd~>\tq\ufffdH\u018d\ufffd=\u0000\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0005\ufffd=%d#\ufffdJL\ufffd\ufffd\ufffde^\ufffdW?\u0014M\ufffd]\ufffdn\ufffd\ufffd\u0002\r\ufffd\u000f",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003{iJ\u0005D\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u001c\ufffd`\ufffdQ\u001bc\ufffdXd?\ufffd\ufffd\u025d\u017c\/\ufffd n3\t\ufffdd\ufffd\ufffdO?C\ufffd\u0018% lK\ufffd\ufffd\ufffd\ufffd\ufffd~>\tq\ufffdH\u018d\ufffd=\u0000\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"ics_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ea0b411b3c25f970d356fb6ceca6d8e1fe862361",
"tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0",
"tls_ja4_hash": "9d78dfefabcee3ee16297d72e4cafc86",
"tls_ja4": "t13d0119_e060b20e9557_cc710080a5f9",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "tls",
"service_banner": "honeypot-tls",
"service_os": "linux",
"dst_port": "2342"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
06/06/2026 21:14:28 UTC
TCP
2342 · HTTP
Sonde port 2342/TCP
Élevée
Faible · 26
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
botnet_http_ua_host
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2342
Chemin / cible
/
Preuve honeypot — Sonde port 2342/TCP
Connexion détectée sur le port 2342 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_2342_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
55%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
curl/7.29.0
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
User-Agent: curl/7.29.0
Host: 62.3.50.33
Accept: */*
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "0315d257123246273ce1f3edb87d478f00f3fce8",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 74,
"payload_entropy": 4.819344967782759,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 2342,
"risk_waf": 32,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30
},
"risk_score": 26,
"tag_count": 5,
"anomaly_count": 1,
"campaign_key": "7f142b4afaf77318e34592308db15f2c5e70b334",
"event_fingerprint": "37b0300111706721a9124f3300f2e66c0dcec76c",
"classification_reason": "Type \u00ab port_2342_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.55,
"classification_confidence": 0.55,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 32,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30,
"risk_score": 26
},
"named_classification_skipped": true,
"named_candidate": "web_scanner",
"service_name": "http",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "a6744e3c06a59e753fc74a2c54c4a161",
"payload_hash": "99559ea3a5e9ac33c4b35f9a75d06c9c",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2342,
"service": "http",
"service_name": "http"
},
"payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
"method": "GET",
"path": "\/",
"user_agent": "curl\/7.29.0",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "curl\/7.29.0",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
"classification_reason": "Type \u00ab port_2342_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "39b080bcc6858b8f80b33d383e2e0e04696dc096",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2342"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"botnet_http_ua_host",
"http_ua_suspicious",
"scanner-ua"
]
}
06/06/2026 21:14:23 UTC
TCP
2342
—
Sonde port
Faible
Faible · 17
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
2342
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": null,
"app_proto": null,
"asn": 135377,
"country": "TH",
"dst_port": 2342,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 17,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "ac5a83afc3bba0f77e8e05da4818b7d945e9ff5f",
"event_fingerprint": "2b6efbd9817980828206d4119429c0c18942038f",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 17
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 2342
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7c6e52f6c57f798781fd144c809b32d5fa09c711",
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "2342"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "probe",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
06/06/2026 19:34:13 UTC
TCP
3741
Sonde HTTP
Moyenne
Faible · 20
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
3741
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 94%
Confiance classification
94%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:3741
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "a5e7d16cdb2843cd3aec8e7c05b53f3a5937090f",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.932011249372491,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 3741,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 20,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "acca7f033209b7c3bf3ac3674a2ac77ad4b01363",
"event_fingerprint": "c0d93b9e8f3ed250affefa09d3d583f54224642e",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%",
"confidence": 0.94,
"classification_confidence": 0.94,
"precision_score": 102,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"risk_confidence_factor": 94,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "baaf390229b84a6dcf61ac1a22dd232d",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 3741,
"service": "http"
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "449506ec57f55073dbcb55a5ca36951f696cde6d",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
06/06/2026 19:34:13 UTC
TCP
3741
Sonde HTTP
Moyenne
Faible · 20
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
3741
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 94%
Confiance classification
94%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:3741
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "a5e7d16cdb2843cd3aec8e7c05b53f3a5937090f",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 4.916438313567961,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 3741,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 20,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "acca7f033209b7c3bf3ac3674a2ac77ad4b01363",
"event_fingerprint": "89fbb7f9890a430ea1e5edc5de661b78b75fcba1",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%",
"confidence": 0.94,
"classification_confidence": 0.94,
"precision_score": 102,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"risk_confidence_factor": 94,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "9820b31bd621d4cb7c919b135ac79dad",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 3741,
"service": "http"
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4f5c962b8809e6ba3b2ab0427d7c94dc289b77d8",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
06/06/2026 19:34:13 UTC
TCP
3741
Sonde HTTP
Moyenne
Faible · 15
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
3741
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 34%
Confiance classification
34%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:3741
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "a5e7d16cdb2843cd3aec8e7c05b53f3a5937090f",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.975612539636963,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 3741,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 15,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "acca7f033209b7c3bf3ac3674a2ac77ad4b01363",
"event_fingerprint": "ea816b9778bb1bd5a3e4372f85afd5dba8124030",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 34%",
"confidence": 0.34,
"classification_confidence": 0.34,
"precision_score": 40,
"precision_signals": [
"INT-single-port"
],
"kb_rule_ids": [
"INT-single-port"
],
"risk_confidence_factor": 34,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "c70030b5a48ae805d3fe1dbfc28d6925",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 3741,
"service": "http"
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 34%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "524bccaae85201724ef4fdcc9dc370e07aeba4d4",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
06/06/2026 19:34:12 UTC
TCP
3741
Tentative d'exploit
Élevée
Moyen · 46
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
3741
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit/592.45 (KHTML, like Gecko) Chrome/98.0.502 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:3741
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit/592.45 (KHTML, like
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:3741 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit/592.45 (KHTML, like Gecko) Chrome/98.0.502 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "2f0ac23310201203cfe027c3f61649d2bbc4ead9",
"http_host_hash": "a5e7d16cdb2843cd3aec8e7c05b53f3a5937090f",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 211,
"payload_entropy": 5.40716824665226,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 3741,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "31a6b96c519d9ba703948c74ac2487593292b3a9",
"event_fingerprint": "28c92456bdcdf0456ecf82f79361b1cbf376da20",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "ecb2486edbcd8f14295c68405df719aa",
"payload_hash": "3bc6e12b45db1f4429a8ce1391239ae4",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3741,
"service": "http"
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit\/592.45 (KHTML, like",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit\/592.45 (KHTML, like Gecko) Chrome\/98.0.502 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit\/592.45 (KHTML, like Gecko) Chrome\/98.0.502 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit\/592.45 (KHTML, like",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit\/592.45 (KHTML, like Gecko) Chrome\/98.0.502 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit\/592.45 (KHTML, like Gecko) Chrome\/98.0.502 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:3741\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 9_1_1) AppleWebKit\/592.45 (KHTML, like",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "570c90a5494ff436d9866569f31c7d331484557b",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
06/06/2026 19:01:30 UTC
TCP
2132
Sonde HTTP
Moyenne
Faible · 20
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2132
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 94%
Confiance classification
94%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:2132
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "59bef5246172d95b523ed50916b5affa83628423",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 4.878399213550653,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 2132,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 20,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "f0124e382d80e5f68e20b3183281f6b3816a70f3",
"event_fingerprint": "33816db8c69eadbd1234b84ffa0fa882c86a99d3",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%",
"confidence": 0.94,
"classification_confidence": 0.94,
"precision_score": 102,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"risk_confidence_factor": 94,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "3a7046e75c56a8394a7eb013137ca7c4",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 2132,
"service": "http"
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "238a6168617960f3050a833373237679a9db6052",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
06/06/2026 19:01:30 UTC
TCP
2132
Sonde HTTP
Moyenne
Faible · 15
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2132
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 34%
Confiance classification
34%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:2132
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "59bef5246172d95b523ed50916b5affa83628423",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.9378753372388395,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 2132,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 15,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "f0124e382d80e5f68e20b3183281f6b3816a70f3",
"event_fingerprint": "0ef5930fd71983d624db5e8efc1ff42753ca5fb0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 34%",
"confidence": 0.34,
"classification_confidence": 0.34,
"precision_score": 40,
"precision_signals": [
"INT-single-port"
],
"kb_rule_ids": [
"INT-single-port"
],
"risk_confidence_factor": 34,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "d5b0d143d046dfa2828db7406e777fe1",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 2132,
"service": "http"
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 34%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "00777bd3a5bf38f9e1293530a06c8fc968408d4a",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
06/06/2026 19:01:29 UTC
TCP
2132
Tentative d'exploit
Élevée
Moyen · 47
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2132
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 8_0_2) AppleWebKit/562.40 (KHTML, like Gecko) Chrome/78.0.2964 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2132
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 8_0_2) AppleWebKit/562.40 (KHTML, like
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2132 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 8_0_2) AppleWebKit/562.40 (KHTML, like Gecko) Chrome/78.0.2964 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "9c00b4fefc3e3fb0e161a42c4da33569ba539120",
"http_host_hash": "59bef5246172d95b523ed50916b5affa83628423",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 212,
"payload_entropy": 5.40959714667911,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 2132,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "180e0e322eb93e5d07ddf57f8115df1082c1e760",
"event_fingerprint": "4ae2b523845fc4778acd178cef72f61689f4819c",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "65208bb5e115a4046cc6e7ad8182e92a",
"payload_hash": "499fa2bebc1723231a8499b780dd4611",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2132,
"service": "http"
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_2) AppleWebKit\/562.40 (KHTML, like",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_2) AppleWebKit\/562.40 (KHTML, like Gecko) Chrome\/78.0.2964 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_2) AppleWebKit\/562.40 (KHTML, like Gecko) Chrome\/78.0.2964 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_2) AppleWebKit\/562.40 (KHTML, like",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_2) AppleWebKit\/562.40 (KHTML, like Gecko) Chrome\/78.0.2964 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_2) AppleWebKit\/562.40 (KHTML, like Gecko) Chrome\/78.0.2964 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 8_0_2) AppleWebKit\/562.40 (KHTML, like",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "80073a7976532725e7f10ef6b627ed08c1cba427",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
06/06/2026 19:01:29 UTC
TCP
2132
Sonde HTTP
Moyenne
Faible · 20
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2132
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 94%
Confiance classification
94%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:2132
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "59bef5246172d95b523ed50916b5affa83628423",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.894274046974368,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 2132,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 20,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "f0124e382d80e5f68e20b3183281f6b3816a70f3",
"event_fingerprint": "541551b3743bce667a666dfd2c7550d9ac6f0df0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%",
"confidence": 0.94,
"classification_confidence": 0.94,
"precision_score": 102,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"risk_confidence_factor": 94,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "0a6f2b6d11e64433c0832fc5b2ba01e8",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 2132,
"service": "http"
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2132\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "704d1e55eac4f6fc22ee98fc3e8b117643f0eb0b",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
06/06/2026 15:25:56 UTC
TCP
2215
Sonde HTTP
Moyenne
Faible · 19
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2215
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 94%
Confiance classification
94%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:2215
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "09f82540a85025587e35833e99d09cc36bec1ce2",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.904155892195293,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 2215,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 19,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "fa487e144304357a323a5aa65a45b09b56957c56",
"event_fingerprint": "3e43d07c1e4a599ed8ef602afdaf82effe431b2c",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%",
"confidence": 0.94,
"classification_confidence": 0.94,
"precision_score": 102,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"risk_confidence_factor": 94,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "7e9a9a473f8a25875169407424ffd863",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 2215,
"service": "http"
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "be48bf8454531a7e8aa3eff126982c74d76e76fc",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
06/06/2026 15:25:56 UTC
TCP
2215
Sonde HTTP
Moyenne
Faible · 19
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2215
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 94%
Confiance classification
94%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:2215
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "09f82540a85025587e35833e99d09cc36bec1ce2",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 4.888360113533345,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 2215,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 19,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "fa487e144304357a323a5aa65a45b09b56957c56",
"event_fingerprint": "f88694b03935346827472f4d8cb9640140539320",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%",
"confidence": 0.94,
"classification_confidence": 0.94,
"precision_score": 102,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"risk_confidence_factor": 94,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "0707c789ef71934cc4fa0a1571f5bbb7",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 2215,
"service": "http"
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a298638d6e45b700f02c35a912c9b3c4f4bf60a8",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
06/06/2026 15:25:56 UTC
TCP
2215
Sonde HTTP
Moyenne
Faible · 14
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2215
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 34%
Confiance classification
34%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:2215
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "09f82540a85025587e35833e99d09cc36bec1ce2",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.947757182459765,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 2215,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 14,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "fa487e144304357a323a5aa65a45b09b56957c56",
"event_fingerprint": "c09668f2249fb8d1388d854651814307b5f6f73e",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 34%",
"confidence": 0.34,
"classification_confidence": 0.34,
"precision_score": 40,
"precision_signals": [
"INT-single-port"
],
"kb_rule_ids": [
"INT-single-port"
],
"risk_confidence_factor": 34,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "836370332c2ef3a42a917711899dea19",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 2215,
"service": "http"
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 34%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c26b9b624dd6a1fc6f4ae2d45ebbdbc8bbfb7d72",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
06/06/2026 15:25:55 UTC
TCP
2215
Tentative d'exploit
Élevée
Moyen · 45
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2215
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit/601.55 (KHTML, like Gecko) Chrome/97.0.1250 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2215
User-Agent: Mozilla/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit/601.55 (KHTML, like Geck
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2215 User-Agent: Mozilla/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit/601.55 (KHTML, like Gecko) Chrome/97.0.1250 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "87e352d7192995b83f4c385dcee0490ce099af81",
"http_host_hash": "09f82540a85025587e35833e99d09cc36bec1ce2",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 207,
"payload_entropy": 5.407055594701507,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 2215,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.3,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "7bd147c0fc9e1f8de747a652f8cac74f58a0483c",
"event_fingerprint": "bf4a3618aa045c7a2abbc02ecb07d3f95d616d52",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "97550c283c015857f650a016ea99e99e",
"payload_hash": "80e82fc268455252707419547513a772",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2215,
"service": "http"
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/601.55 (KHTML, like Geck",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/601.55 (KHTML, like Gecko) Chrome\/97.0.1250 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/601.55 (KHTML, like Gecko) Chrome\/97.0.1250 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/601.55 (KHTML, like Geck",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/601.55 (KHTML, like Gecko) Chrome\/97.0.1250 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/601.55 (KHTML, like Gecko) Chrome\/97.0.1250 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2215\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_1; Win64; x64) AppleWebKit\/601.55 (KHTML, like Geck",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4ca40ba43e3a700e30e5d6bc5567755a0834f69c",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
06/06/2026 08:51:23 UTC
TCP
2658
Sonde HTTP
Moyenne
Faible · 20
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2658
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 94%
Confiance classification
94%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:2658
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "8e8064e88c49f89f67f21d9d57add9bd7c15a634",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.938795003120691,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 2658,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 20,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "6cd6a810349af6de56052a19acb0d95f16fd1be5",
"event_fingerprint": "b8a15b22097e5b479b867e100b69dd193befa4c4",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%",
"confidence": 0.94,
"classification_confidence": 0.94,
"precision_score": 102,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"risk_confidence_factor": 94,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "baa7cabfa29dd3da2099b21827ae98ba",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 2658,
"service": "http"
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e07801f148787a9f5af5aa60555d2e273b5cc406",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
06/06/2026 08:51:23 UTC
TCP
2658
Sonde HTTP
Moyenne
Faible · 20
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2658
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 94%
Confiance classification
94%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:2658
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "8e8064e88c49f89f67f21d9d57add9bd7c15a634",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 4.923276337346147,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 2658,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 20,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "6cd6a810349af6de56052a19acb0d95f16fd1be5",
"event_fingerprint": "4b2ac5d0322c0559d4aa306dd98595d76a2a9fb4",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%",
"confidence": 0.94,
"classification_confidence": 0.94,
"precision_score": 102,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"risk_confidence_factor": 94,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "1b36110e9c23f1d251035da5ef7e34b7",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 2658,
"service": "http"
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f5e96bfcab3e9187674d377a900b0913e923beb0",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
06/06/2026 08:51:23 UTC
TCP
2658
Sonde HTTP
Moyenne
Faible · 15
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2658
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 34%
Confiance classification
34%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:2658
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "8e8064e88c49f89f67f21d9d57add9bd7c15a634",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.982396293385163,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 2658,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 15,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "6cd6a810349af6de56052a19acb0d95f16fd1be5",
"event_fingerprint": "226d561625766a0e0715634d7c78dab7af3a6774",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 34%",
"confidence": 0.34,
"classification_confidence": 0.34,
"precision_score": 40,
"precision_signals": [
"INT-single-port"
],
"kb_rule_ids": [
"INT-single-port"
],
"risk_confidence_factor": 34,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "194bb58f971acb0a895ffd392ad40eae",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 2658,
"service": "http"
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 34%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "84c7103df4cc6f83a1359394331b7317eefa710b",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
06/06/2026 08:51:23 UTC
TCP
2658
Tentative d'exploit
Élevée
Moyen · 47
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
2658
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit/602.51 (KHTML, like Gecko) Chrome/85.0.1836 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2658
User-Agent: Mozilla/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit/602.51 (KHTML, like Ge
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2658 User-Agent: Mozilla/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit/602.51 (KHTML, like Gecko) Chrome/85.0.1836 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "fa42cb38f347a1d0324fd68483bdf3e9d3526cb9",
"http_host_hash": "8e8064e88c49f89f67f21d9d57add9bd7c15a634",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 209,
"payload_entropy": 5.416922760629375,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 2658,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.7,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 47,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "d9809ae2ae222873ece078be57e2e0b1fab9f127",
"event_fingerprint": "d6b31ae48d9e7304998d620806acd69bb6a63c01",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7893e446967c6323c2f6be72a616657f",
"payload_hash": "e57c5fa1198df2afe3ef15e27020d9d0",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2658,
"service": "http"
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/602.51 (KHTML, like Ge",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/602.51 (KHTML, like Gecko) Chrome\/85.0.1836 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/602.51 (KHTML, like Gecko) Chrome\/85.0.1836 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/602.51 (KHTML, like Ge",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/602.51 (KHTML, like Gecko) Chrome\/85.0.1836 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/602.51 (KHTML, like Gecko) Chrome\/85.0.1836 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2658\r\nUser-Agent: Mozilla\/5.0 (Windows NT 7_0_1; Win64; x64) AppleWebKit\/602.51 (KHTML, like Ge",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "da5d228c8b6d5ea7fd1b471d98f931c9189d46ec",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}
06/06/2026 00:39:49 UTC
TCP
910
Sonde PostgreSQL
Élevée
Faible · 21
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
tls_ja3
tls_no_sni
tls_weak_cipher
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
910
Chemin / cible
—
Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
PostgreSQL startup
Minecraft varint handshake
SOCKS5 greeting
SIP TLS ClientHello
TFTP RRQ
User-Agent
—
Règles WAF
—
Payload (extrait)
� �g�၊%Ʌ����~�� �7W�Gf@}z� �����D 2��?DT�vTB^���k��_�r9� &�+�/�,�0̨̩� ��
� � � / 5�
�
Requête brute (extrait)
� �g�၊%Ʌ����~�� �7W�Gf@}z� �����D 2��?DT�vTB^���k��_�r9� &�+�/�,�0̨̩� �� � � � / 5� � + 3 & $ ��ސ� .�V�F� �?o� �%+1Fs���_
Meta JSON brut
{
"tls_ja3_hash": "9460af62ae0af667130bf0d36514f084",
"tls_sni": null,
"tls_weak_cipher": true,
"tls_weak_cipher_count": 4,
"bytes_in": 247,
"payload_entropy": 5.779578685197686,
"port_category": "well_known",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "tls",
"app_proto": "tls",
"asn": 135377,
"country": "TH",
"dst_port": 910,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 6,
"risk_granularity": 2.8,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 21,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "3edd1ef8598f5ca4a2f7ffa5cc506e12a2138978",
"event_fingerprint": "2b0399886797ed076e73bca712391647a47c2765",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0369"
],
"kb_rule_ids": [
"pat-0369"
],
"matched_patterns": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"matched_pattern_names": [
"PostgreSQL startup",
"Minecraft varint handshake",
"SOCKS5 greeting",
"SIP TLS ClientHello",
"TFTP RRQ"
],
"pattern_ids": [
"pat-0369",
"pat-0554",
"pat-0567",
"pat-0578",
"pat-0536"
],
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"ja3": "9460af62ae0af667130bf0d36514f084",
"payload_hash": "3714f6aac04d73836f8bece3fcad878b",
"path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
},
"target_context": {
"dst_port": 910,
"service": "tls"
},
"payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0004g\ufffd\u0014\u104a%\u0245\ufffd\u000f\ufffd\ufffd\ufffd~\ufffd\ufffd \ufffd7W\ufffdGf\u001a@}z\u0013\ufffd \ufffd\u0004\ufffd\ufffd\ufffd\ufffdD\f2\ufffd\ufffd?DT\ufffdvTB^\ufffd\u0014\ufffd\ufffd\u0004k\ufffd\ufffd_\ufffdr9\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0004g\ufffd\u0014\u104a%\u0245\ufffd\u000f\ufffd\ufffd\ufffd~\ufffd\ufffd \ufffd7W\ufffdGf\u001a@}z\u0013\ufffd \ufffd\u0004\ufffd\ufffd\ufffd\ufffdD\f2\ufffd\ufffd?DT\ufffdvTB^\ufffd\u0014\ufffd\ufffd\u0004k\ufffd\ufffd_\ufffdr9\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u0790\ufffd\n.\ufffdV\ufffdF\ufffd\u001f\ufffd?o\ufffd \ufffd%+1Fs\ufffd\u000f\ufffd\ufffd_\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0004g\ufffd\u0014\u104a%\u0245\ufffd\u000f\ufffd\ufffd\ufffd~\ufffd\ufffd \ufffd7W\ufffdGf\u001a@}z\u0013\ufffd \ufffd\u0004\ufffd\ufffd\ufffd\ufffdD\f2\ufffd\ufffd?DT\ufffdvTB^\ufffd\u0014\ufffd\ufffd\u0004k\ufffd\ufffd_\ufffdr9\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"evidence": {
"request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0004g\ufffd\u0014\u104a%\u0245\ufffd\u000f\ufffd\ufffd\ufffd~\ufffd\ufffd \ufffd7W\ufffdGf\u001a@}z\u0013\ufffd \ufffd\u0004\ufffd\ufffd\ufffd\ufffdD\f2\ufffd\ufffd?DT\ufffdvTB^\ufffd\u0014\ufffd\ufffd\u0004k\ufffd\ufffd_\ufffdr9\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \ufffd\ufffd\u0790\ufffd\n.\ufffdV\ufffdF\ufffd\u001f\ufffd?o\ufffd \ufffd%+1Fs\ufffd\u000f\ufffd\ufffd_\u0003",
"payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0004g\ufffd\u0014\u104a%\u0245\ufffd\u000f\ufffd\ufffd\ufffd~\ufffd\ufffd \ufffd7W\ufffdGf\u001a@}z\u0013\ufffd \ufffd\u0004\ufffd\ufffd\ufffd\ufffdD\f2\ufffd\ufffd?DT\ufffdvTB^\ufffd\u0014\ufffd\ufffd\u0004k\ufffd\ufffd_\ufffdr9\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
"classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9079987f387c2207fdfd89fa35f9458420485fe0",
"ban_policy": "advisory_monitor",
"tags_list": [
"tls_ja3",
"tls_no_sni",
"tls_weak_cipher"
]
}
06/06/2026 00:39:49 UTC
TCP
910
—
Sonde port
Faible
Faible · 16
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
910
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Payload (extrait)
t3 12.1.2
AS:2048
HL:19
Meta JSON brut
{
"bytes_in": 25,
"payload_entropy": 3.7834651896016456,
"port_category": "well_known",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": null,
"app_proto": null,
"asn": 135377,
"country": "TH",
"dst_port": 910,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 16,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "e48cb50914536ab26cefb1587919335a98ebd3a4",
"event_fingerprint": "84aa2978171b10c3718eb1415275ce140db19b08",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-single-port"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "588580493dbf1d2ca7cd7f2cd09ed672",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 910
},
"payload_preview": "t3 12.1.2\nAS:2048\nHL:19\n\n",
"request_sample": "t3 12.1.2\nAS:2048\nHL:19\n\n",
"payload_snippet": "t3 12.1.2\nAS:2048\nHL:19",
"evidence": {
"request_sample": "t3 12.1.2\nAS:2048\nHL:19\n\n",
"payload_snippet": "t3 12.1.2\nAS:2048\nHL:19",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c3bbea0fa11e12e0b7aa3b1f70032c6f10b76006",
"ban_policy": "advisory_monitor"
}
06/06/2026 00:39:48 UTC
TCP
910
Scanner web
Élevée
Faible · 15
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
6
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
scanner-ua
anomaly:scanner-ua
botnet_http_ua_host
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
910
Chemin / cible
/
Pourquoi cette classification : Règle WAF « scanner-ua » · confiance 0%
Confiance classification
0%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
curl/7.29.0
Règles WAF
sap-sapcontrol-path
scanner-ua
Payload (extrait)
GET / HTTP/1.1
User-Agent: curl/7.29.0
Host: 62.3.50.33
Accept: */*
Meta JSON brut
{
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "0315d257123246273ce1f3edb87d478f00f3fce8",
"http_host_hash": "0991dad1e85d945fa26d249d6238901b89cb8349",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 74,
"payload_entropy": 4.819344967782759,
"port_category": "well_known",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 910,
"risk_waf": 32,
"risk_classification": 42,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 3.5,
"risk_breakdown": {
"waf": 32,
"classification": 42,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 30
},
"risk_score": 15,
"tag_count": 5,
"anomaly_count": 1,
"campaign_key": "6b1a95aeb655fcd1dd5a972b967619b256fd1dc6",
"event_fingerprint": "b615cb0d2c8027aef6f5d3487e19f1f8e5af95e0",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "a6744e3c06a59e753fc74a2c54c4a161",
"payload_hash": "99559ea3a5e9ac33c4b35f9a75d06c9c",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 910,
"service": "http"
},
"payload_preview": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
"method": "GET",
"path": "\/",
"user_agent": "curl\/7.29.0",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "curl\/7.29.0",
"waf_tags": [
"950734:sap-sapcontrol-path",
"scanner-ua"
],
"waf_rule_names": [
"sap-sapcontrol-path",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nUser-Agent: curl\/7.29.0\r\nHost: 62.3.50.33\r\nAccept: *\/*",
"classification_reason": "R\u00e8gle WAF \u00ab scanner-ua \u00bb \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"disclosed_scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "23adf52a7d95acc992d7ce63ee4223f74b6b3b30",
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"anomaly:scanner-ua",
"botnet_http_ua_host",
"http_ua_suspicious",
"scanner-ua"
]
}
06/06/2026 00:39:42 UTC
TCP
910
—
Sonde port
Faible
Faible · 16
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
910
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": null,
"app_proto": null,
"asn": 135377,
"country": "TH",
"dst_port": 910,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 16,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "e48cb50914536ab26cefb1587919335a98ebd3a4",
"event_fingerprint": "84aa2978171b10c3718eb1415275ce140db19b08",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-single-port"
],
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 910
},
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "866693e27add6fed4f01f8e1fb3e5b411c262374",
"ban_policy": "advisory_monitor"
}
04/06/2026 21:37:42 UTC
TCP
6058
Sonde HTTP
Moyenne
Faible · 19
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
6058
Chemin / cible
/favicon.ico
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 94%
Confiance classification
94%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33:6058
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "ico",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "fd4372dd928f60274cf68aabf6abd8b8000abc27",
"http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.938795003120691,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 6058,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 19,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1759316ca2fff6a2e7431bd94ab5b7eebcf7fc1e",
"event_fingerprint": "4f4ac6d8ea2221dc19f60c4f9b0224b083254823",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%",
"confidence": 0.94,
"classification_confidence": 0.94,
"precision_score": 102,
"precision_signals": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-favicon",
"INT-single-port",
"INT-benign-path-cap"
],
"risk_confidence_factor": 94,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "b337dcf242359cf69794b39db37a6678",
"path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
},
"target_context": {
"dst_port": 6058,
"service": "http"
},
"payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/favicon.ico",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/favicon.ico HTTP\/1.1",
"request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a350df99716a3649aba9060a271ff470472ab939",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
04/06/2026 21:37:42 UTC
TCP
6058
Sonde HTTP
Moyenne
Faible · 14
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/sitemap.xml
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
6058
Chemin / cible
/sitemap.xml
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 34%
Confiance classification
34%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /sitemap.xml HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /sitemap.xml HTTP/1.1
Host: 62.3.50.33:6058
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "xml",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "fd4372dd928f60274cf68aabf6abd8b8000abc27",
"http_target_hash": "aefeebe85207f9638bc792aa32d2470b82e35120",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 126,
"payload_entropy": 4.982396293385163,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 6058,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 14,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1759316ca2fff6a2e7431bd94ab5b7eebcf7fc1e",
"event_fingerprint": "c3d2dca8665e276d2a6a1e9839e191b830856347",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 34%",
"confidence": 0.34,
"classification_confidence": 0.34,
"precision_score": 40,
"precision_signals": [
"INT-single-port"
],
"kb_rule_ids": [
"INT-single-port"
],
"risk_confidence_factor": 34,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "1daeb5f5692fa652c29ca5b606d0f20c",
"path_pattern_hash": "7efd2a819481844ebcfd47a818831daf"
},
"target_context": {
"dst_port": 6058,
"service": "http"
},
"payload_preview": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/sitemap.xml",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/sitemap.xml HTTP\/1.1",
"request_sample": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/sitemap.xml HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 34%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "35e47810056a1a1eaf48110174a6a7261e6ab2bd",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
04/06/2026 21:37:42 UTC
TCP
6058
Sonde HTTP
Moyenne
Faible · 19
Détails
Voir
Étape
Sonde / probe
MITRE
TA0007
TA0001
WAF
0
Recommandation
Surveiller
Tags
http_ua_suspicious
Cible HTTP
GET
/robots.txt
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
6058
Chemin / cible
/robots.txt
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 94%
Confiance classification
94%
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET /robots.txt HTTP/1.1
User-Agent
Go-http-client/1.1
Règles WAF
—
Payload (extrait)
GET /robots.txt HTTP/1.1
Host: 62.3.50.33:6058
User-Agent: Go-http-client/1.1
Accept-Encoding: gzip
Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "txt",
"http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2",
"http_host_hash": "fd4372dd928f60274cf68aabf6abd8b8000abc27",
"http_target_hash": "b7a9adb9fec4116c29da690c45d9a67df535af9d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 125,
"payload_entropy": 4.923276337346147,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 6058,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 2.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 15
},
"risk_score": 19,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "1759316ca2fff6a2e7431bd94ab5b7eebcf7fc1e",
"event_fingerprint": "da622e05f2e978dc87018b6c53657851fb28e809",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%",
"confidence": 0.94,
"classification_confidence": 0.94,
"precision_score": 102,
"precision_signals": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"kb_rule_ids": [
"INT-benign-robots",
"INT-single-port",
"INT-benign-path-cap"
],
"risk_confidence_factor": 94,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1",
"payload_hash": "2b07299fc52ab966241956cbfde1e460",
"path_pattern_hash": "adada1317532a28bebf63fe6edbea3e4"
},
"target_context": {
"dst_port": 6058,
"service": "http"
},
"payload_preview": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/robots.txt",
"user_agent": "Go-http-client\/1.1",
"request_line": "GET \/robots.txt HTTP\/1.1",
"request_sample": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/robots.txt HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Go-http-client\/1.1\r\nAccept-Encoding: gzip\r\nConnection: close",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 94%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9a462376740135484709c4bcacc810efda9a36dc",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_ua_suspicious"
]
}
04/06/2026 21:37:41 UTC
TCP
6058
Tentative d'exploit
Élevée
Moyen · 45
Détails
Voir
Étape
Tentative d'exploit
MITRE
TA0001
TA0002
WAF
16
Recommandation
Surveiller
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
6058
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 9_0_1; Win64; x64) AppleWebKit/583.51 (KHTML, like Gecko) Chrome/71.0.2940 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:6058
User-Agent: Mozilla/5.0 (Windows NT 9_0_1; Win64; x64) AppleWebKit/583.51 (KHTML, like Ge
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:6058 User-Agent: Mozilla/5.0 (Windows NT 9_0_1; Win64; x64) AppleWebKit/583.51 (KHTML, like Gecko) Chrome/71.0.2940 Safari/537.36 Accept-Encoding: gzip Connection: close
Meta JSON brut
{
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "aab2bb9a812ff5e6c1908b94c1263d4457f07026",
"http_host_hash": "fd4372dd928f60274cf68aabf6abd8b8000abc27",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 209,
"payload_entropy": 5.440351454180761,
"port_category": "registered",
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"service": "http",
"app_proto": "http",
"asn": 135377,
"country": "TH",
"dst_port": 6058,
"risk_waf": 72,
"risk_classification": 72,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 25,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3.1,
"risk_breakdown": {
"waf": 72,
"classification": 72,
"behavior": 0,
"geo": 0,
"protocol": 25,
"novelty": 15
},
"risk_score": 45,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "20762c7130df9bcc35ddbef80a3cd5e33e4c6364",
"event_fingerprint": "d9944de63887eec7e4ba73e555871c9f241d73c1",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%",
"confidence": 0.62,
"classification_confidence": 0.62,
"precision_score": 73,
"precision_signals": [
"MITRE-T1190"
],
"kb_rule_ids": [
"MITRE-T1190"
],
"risk_confidence_factor": 62,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "TH",
"asn": 135377,
"org": "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "383e354edb0c973ca91cf104b7770387",
"payload_hash": "a7f86e5abe0f1f801bf03a3a9adb088a",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 6058,
"service": "http"
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_0_1; Win64; x64) AppleWebKit\/583.51 (KHTML, like Ge",
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 9_0_1; Win64; x64) AppleWebKit\/583.51 (KHTML, like Gecko) Chrome\/71.0.2940 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_0_1; Win64; x64) AppleWebKit\/583.51 (KHTML, like Gecko) Chrome\/71.0.2940 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_0_1; Win64; x64) AppleWebKit\/583.51 (KHTML, like Ge",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 9_0_1; Win64; x64) AppleWebKit\/583.51 (KHTML, like Gecko) Chrome\/71.0.2940 Safari\/537.36",
"waf_tags": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_0_1; Win64; x64) AppleWebKit\/583.51 (KHTML, like Gecko) Chrome\/71.0.2940 Safari\/537.36\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:6058\r\nUser-Agent: Mozilla\/5.0 (Windows NT 9_0_1; Win64; x64) AppleWebKit\/583.51 (KHTML, like Ge",
"classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "00c33d973742dea9e1426c324a14eba4d79cc951",
"ban_policy": "advisory_monitor",
"tags_list": [
"950326:rce-0",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
]
}