Renseignement sur les menaces

États-Unis

124.198.131.39

FAI 1337 Services GmbH Première vue 30/05/2026 23:58 UTC Dernière vue 16/06/2026 22:27 UTC Risque Critique

Période analysée : 2026-05-18 → 2026-06-17

Activité suspecte — risque 75/100 (Élevé) — MITRE TA0001 — confiance 95 % — via HTTP

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

100

Critique · Risque max (7j) Critique

Synthèse exécutive

Profil de menace

Score de risque 100/100 Critique

Première observation 30/05/2026 23:58 UTC

Dernière observation 16/06/2026 22:27 UTC

Événements (période) 46

MITRE ATT&CK principal TA0001 20 occurrences

Activité suspecte — risque 75/100 (Élevé) — MITRE TA0001 — confiance 95 % — via HTTP

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%

Confiance 95 % — Score WAF 100 · 7 tag(s) WAF

Comparaison ASN / FAI

ASN 210558 · 124.198.131.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 46 événements sur la période pour cette IP.

124.198.132.219 Agent personnel 14/06/2026 12:45 UTC
185.241.208.27 web attack 26/05/2026 13:17 UTC
124.198.131.22 web attack 22/05/2026 04:12 UTC
193.26.115.53 web attack 19/05/2026 03:41 UTC
192.159.99.123 Sonde HTTP 17/05/2026 05:49 UTC
45.154.98.160 web attack 15/05/2026 19:20 UTC
45.154.98.199 Sonde port 05/05/2026 23:08 UTC
124.198.131.213 web attack 03/05/2026 00:27 UTC

Événements (filtres)

Première observation

30/05/2026 23:58 UTC

Dernière observation

16/06/2026 22:27 UTC

Dernière activité (filtres)

16/06/2026 22:27 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Géolocalisation

Origine réseau déclarée

États-Unis unknown unknown

FAI / réseau

Opérateur et dernière activité ban

1337 Services GmbH 10 Port 3001 http_smuggling_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Chaîne d'attaque

Exploitation

Vecteur d'attaque

http smuggling probe · via HTTP:3001 · (tentative d'exploit) · → /api

Détails protocole

Méthode: POST
Chemin: /api
User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io)

Aperçu payload

POST /api HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-

Port / service

3001 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 95 % — Motif catalogue confirmé · 7 tag(s) WAF

Technique MITRE

TA0001

Persona capteur

mail.sensor-1.internal

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0842

Confiance

95%

Famille de menace

web_injection

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

46 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

46 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
16/06/2026 22:27:10 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit) · → /api	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST /api UA Mozilla/5.0 (rondo2012@atomicmail.io) Émulateur HTTP WAF 42 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /api TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible /api Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 7 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x- Requête brute (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.478667111768798, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 12, "anomaly_count": 0, "campaign_key": "35f3648428f0705c76891216c3204d8f2f534a13", "event_fingerprint": "82784f43a5e9f3ee94ecdb86dca53a33b02b4a21", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "3b8c2c879798f1f43275e22e2511db86", "path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "evidence": { "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "65b6a77e7cc7c9afbae1ce88338fa695926a207b", "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_contenttype_attack_surface", "http_jwt_body", "http_probe_api", "http_prototype_pollution", "net_web_probe" ] }
16/06/2026 13:05:03 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 (rondo2012@atomicmail.io) Émulateur HTTP WAF 41 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 7 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-com Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 --0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 948, "payload_entropy": 5.4794506755355865, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 11, "anomaly_count": 0, "campaign_key": "16045e382a3ac0419a30cc2767cc830ddd8b14d8", "event_fingerprint": "16e2c48fbcd6b17a02278bce3dc927a637697700", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "d6a77f7155fd6364a14579895cf8b008", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n--0", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n--0", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e5c5f2b35e2c0f294097dd46240d0a3166090f49", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
16/06/2026 12:29:26 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 (rondo2012@atomicmail.io) Émulateur HTTP WAF 41 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 7 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-com Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 --0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 948, "payload_entropy": 5.478238412114009, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 11, "anomaly_count": 0, "campaign_key": "90ea064381b843b95a563c95412ddc1b8246b652", "event_fingerprint": "ed7cd4b5808a7b0088bf2b6ff027999d206ef1c8", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "322b43884cbce88b88289e03f1f39923", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n--0", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n--0", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "422d770a068488e26da58b2884091183bd79afeb", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
16/06/2026 08:31:43 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit) · → /api	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST /api UA Mozilla/5.0 (rondo2012@atomicmail.io) Émulateur HTTP WAF 42 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /api TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /api Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 7 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x- Requête brute (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.477458672522051, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 12, "anomaly_count": 0, "campaign_key": "9e089fa44ca5cb9f67541f8554dbce8ad2f3b484", "event_fingerprint": "4f99a7d92fe1c1e77fc3a3c563d97b11b0619181", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "c6d347dfc6c60be4890e9a77d1231733", "path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "evidence": { "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "61b13958dce6779ea51334de3c433894585d3ae4", "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_contenttype_attack_surface", "http_jwt_body", "http_probe_api", "http_prototype_pollution", "net_web_probe" ] }
15/06/2026 20:19:58 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 (rondo2012@atomicmail.io) Émulateur HTTP WAF 41 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 7 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-com Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 --0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 948, "payload_entropy": 5.478238412114009, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 11, "anomaly_count": 0, "campaign_key": "90ea064381b843b95a563c95412ddc1b8246b652", "event_fingerprint": "ed7cd4b5808a7b0088bf2b6ff027999d206ef1c8", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "322b43884cbce88b88289e03f1f39923", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n--0", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n--0", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "422d770a068488e26da58b2884091183bd79afeb", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
15/06/2026 19:25:32 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit) · → /app	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST /app UA Mozilla/5.0 (rondo2012@atomicmail.io) Émulateur HTTP WAF 38 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /app TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible /app Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 6 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /app HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 Payload (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x- Requête brute (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.478998262080779, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 10, "anomaly_count": 0, "campaign_key": "60b025df33751b76736cdf683c931f93796a0304", "event_fingerprint": "ba76cda5a5de39507583c01573d44f59579b7605", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "41f7bfcf070fc676200200507bc75278", "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "evidence": { "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "89ddffe072f8cdd8cd91bb098bd58ee265c1ca7b", "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
15/06/2026 16:52:18 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit) · → /api	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST /api UA Mozilla/5.0 (rondo2012@atomicmail.io) Émulateur HTTP WAF 42 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /api TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /api Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 7 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x- Requête brute (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.477458672522051, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 12, "anomaly_count": 0, "campaign_key": "9e089fa44ca5cb9f67541f8554dbce8ad2f3b484", "event_fingerprint": "4f99a7d92fe1c1e77fc3a3c563d97b11b0619181", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "c6d347dfc6c60be4890e9a77d1231733", "path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "evidence": { "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "61b13958dce6779ea51334de3c433894585d3ae4", "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_contenttype_attack_surface", "http_jwt_body", "http_probe_api", "http_prototype_pollution", "net_web_probe" ] }
15/06/2026 13:32:34 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit) · → /app	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST /app UA Mozilla/5.0 (rondo2012@atomicmail.io) Émulateur HTTP WAF 38 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /app TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible /app Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 6 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /app HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 Payload (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x- Requête brute (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.478998262080779, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 10, "anomaly_count": 0, "campaign_key": "60b025df33751b76736cdf683c931f93796a0304", "event_fingerprint": "ba76cda5a5de39507583c01573d44f59579b7605", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "41f7bfcf070fc676200200507bc75278", "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "evidence": { "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "89ddffe072f8cdd8cd91bb098bd58ee265c1ca7b", "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
15/06/2026 11:00:45 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit) · → /api/route	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST /api/route UA Mozilla/5.0 (rondo2012@atomicmail.io) Émulateur HTTP WAF 48 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950468:nosqli-3 Cible HTTP POST /api/route TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /api/route Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api/route HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: t Requête brute (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 6 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 957, "payload_entropy": 5.474723686374105, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 14, "anomaly_count": 0, "campaign_key": "f6d563de983650286e715f00be1695503f34423f", "event_fingerprint": "65e65f62aaa913ad704f645caea35cffc912e98f", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "b9bd2f4cfa8bd354105cbdc2b2908e9d", "path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: t", "method": "POST", "path": "\/api\/route", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api\/route HTTP\/1.1", "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 6", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: t", "evidence": { "method": "POST", "path": "\/api\/route", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api\/route HTTP\/1.1", "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 6", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: t", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cda12a23eb7680937682a3e86319c8db38514bb3", "protocol_details": { "http_method": "POST", "http_path": "\/api\/route", "request_line": "POST \/api\/route HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: t", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/api\/route", "request_line": "POST \/api\/route HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route", "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: t", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_api_route_probe", "http_contenttype_attack_surface", "http_jwt_body", "http_probe_api", "http_prototype_pollution", "net_web_probe" ] }
14/06/2026 11:22:10 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 (rondo2012@atomicmail.io) Émulateur HTTP WAF 41 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 7 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-com Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 --0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 948, "payload_entropy": 5.478238412114009, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 11, "anomaly_count": 0, "campaign_key": "90ea064381b843b95a563c95412ddc1b8246b652", "event_fingerprint": "ed7cd4b5808a7b0088bf2b6ff027999d206ef1c8", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "322b43884cbce88b88289e03f1f39923", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n--0", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n--0", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "422d770a068488e26da58b2884091183bd79afeb", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
13/06/2026 16:45:10 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit) · → /app	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST /app UA Mozilla/5.0 (rondo2012@atomicmail.io) Émulateur HTTP WAF 38 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /app TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /app Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 6 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /app HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 Payload (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x- Requête brute (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.477789822834032, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 10, "anomaly_count": 0, "campaign_key": "9a46813fe56b669239ef8573338eceb7182e5216", "event_fingerprint": "ae01e5d64c65059bfac3d910117e1109010c7099", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "7e8b2e23d5a6c8dcbfc6957a169174e1", "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "evidence": { "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d0afba983d47518dc6cdba598109bc5053fbb5ff", "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
13/06/2026 15:45:04 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit) · → /api	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST /api UA Mozilla/5.0 (rondo2012@atomicmail.io) Émulateur HTTP WAF 42 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /api TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /api Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 7 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x- Requête brute (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.477458672522051, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 12, "anomaly_count": 0, "campaign_key": "9e089fa44ca5cb9f67541f8554dbce8ad2f3b484", "event_fingerprint": "4f99a7d92fe1c1e77fc3a3c563d97b11b0619181", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "c6d347dfc6c60be4890e9a77d1231733", "path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "evidence": { "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "61b13958dce6779ea51334de3c433894585d3ae4", "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 7 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_contenttype_attack_surface", "http_jwt_body", "http_probe_api", "http_prototype_pollution", "net_web_probe" ] }
08/06/2026 07:25:25 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit) · → /app	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST /app UA Mozilla/5.0 (rondo2012@atomicmail.io) Émulateur HTTP WAF 38 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /app TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /app Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 6 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /app HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 Payload (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x- Requête brute (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.477789822834032, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 10, "anomaly_count": 0, "campaign_key": "9a46813fe56b669239ef8573338eceb7182e5216", "event_fingerprint": "ae01e5d64c65059bfac3d910117e1109010c7099", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "7e8b2e23d5a6c8dcbfc6957a169174e1", "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "evidence": { "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d0afba983d47518dc6cdba598109bc5053fbb5ff", "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
08/06/2026 03:30:34 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit) · → /_next	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST /_next UA Mozilla/5.0 (rondo2012@atomicmail.io) Émulateur HTTP WAF 38 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /_next TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /_next Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 6 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /_next HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/ Requête brute (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 953, "payload_entropy": 5.477328163409766, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 10, "anomaly_count": 0, "campaign_key": "9a46813fe56b669239ef8573338eceb7182e5216", "event_fingerprint": "c49bbffea35129d829a515ff116f95c1704735dd", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "5b518f89b56a28e8155688621f409997", "path_pattern_hash": "bfd33612e3863357684bd23d10455a76" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/", "method": "POST", "path": "\/_next", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next HTTP\/1.1", "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/", "evidence": { "method": "POST", "path": "\/_next", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next HTTP\/1.1", "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f26f77e6ba836360f1a88f43a20028c2dc73d0e0", "protocol_details": { "http_method": "POST", "http_path": "\/_next", "request_line": "POST \/_next HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/_next", "request_line": "POST \/_next HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next", "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
08/06/2026 01:23:29 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit) · → /app	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST /app UA Mozilla/5.0 (rondo2012@atomicmail.io) Émulateur HTTP WAF 38 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /app TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /app Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 6 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /app HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 Payload (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x- Requête brute (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.477789822834032, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 10, "anomaly_count": 0, "campaign_key": "9a46813fe56b669239ef8573338eceb7182e5216", "event_fingerprint": "ae01e5d64c65059bfac3d910117e1109010c7099", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "7e8b2e23d5a6c8dcbfc6957a169174e1", "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "evidence": { "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d0afba983d47518dc6cdba598109bc5053fbb5ff", "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
07/06/2026 21:14:57 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit) · → /api/route	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST /api/route UA Mozilla/5.0 (rondo2012@atomicmail.io) Émulateur HTTP WAF 48 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950468:nosqli-3 Cible HTTP POST /api/route TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /api/route Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api/route HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: t Requête brute (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 6 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 957, "payload_entropy": 5.474723686374105, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 14, "anomaly_count": 0, "campaign_key": "f6d563de983650286e715f00be1695503f34423f", "event_fingerprint": "65e65f62aaa913ad704f645caea35cffc912e98f", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "b9bd2f4cfa8bd354105cbdc2b2908e9d", "path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: t", "method": "POST", "path": "\/api\/route", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api\/route HTTP\/1.1", "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 6", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: t", "evidence": { "method": "POST", "path": "\/api\/route", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api\/route HTTP\/1.1", "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 6", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: t", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cda12a23eb7680937682a3e86319c8db38514bb3", "protocol_details": { "http_method": "POST", "http_path": "\/api\/route", "request_line": "POST \/api\/route HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: t", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/api\/route", "request_line": "POST \/api\/route HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route", "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: t", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_api_route_probe", "http_contenttype_attack_surface", "http_jwt_body", "http_probe_api", "http_prototype_pollution", "net_web_probe" ] }
07/06/2026 20:18:58 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit) · → /app	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST /app UA Mozilla/5.0 (rondo2012@atomicmail.io) Émulateur HTTP WAF 38 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /app TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /app Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 6 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /app HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 Payload (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x- Requête brute (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.477789822834032, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 10, "anomaly_count": 0, "campaign_key": "9a46813fe56b669239ef8573338eceb7182e5216", "event_fingerprint": "ae01e5d64c65059bfac3d910117e1109010c7099", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "7e8b2e23d5a6c8dcbfc6957a169174e1", "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "evidence": { "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d0afba983d47518dc6cdba598109bc5053fbb5ff", "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
07/06/2026 13:21:56 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 WAF 38 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /_next TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /_next Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Élevé · 75 Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /_next HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/ Requête brute (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 953, "payload_entropy": 5.477328163409766, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 10, "anomaly_count": 0, "campaign_key": "9a46813fe56b669239ef8573338eceb7182e5216", "event_fingerprint": "c49bbffea35129d829a515ff116f95c1704735dd", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "5b518f89b56a28e8155688621f409997", "path_pattern_hash": "bfd33612e3863357684bd23d10455a76" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/", "method": "POST", "path": "\/_next", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next HTTP\/1.1", "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/", "evidence": { "method": "POST", "path": "\/_next", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next HTTP\/1.1", "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f26f77e6ba836360f1a88f43a20028c2dc73d0e0", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
07/06/2026 13:08:33 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 WAF 42 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /api TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /api Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Élevé · 75 Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x- Requête brute (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.477458672522051, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 12, "anomaly_count": 0, "campaign_key": "9e089fa44ca5cb9f67541f8554dbce8ad2f3b484", "event_fingerprint": "4f99a7d92fe1c1e77fc3a3c563d97b11b0619181", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "c6d347dfc6c60be4890e9a77d1231733", "path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "evidence": { "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "61b13958dce6779ea51334de3c433894585d3ae4", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_contenttype_attack_surface", "http_jwt_body", "http_probe_api", "http_prototype_pollution", "net_web_probe" ] }
07/06/2026 10:35:51 UTC	TCP	3000 · HTTP	http	Prototype pollution	Élevée	Élevé · 69
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 WAF 44 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950468:nosqli-3 Cible HTTP POST /_next/server TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /_next/server Pourquoi cette classification : Règle WAF « proto-0 » · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Élevé · 69 Protocole émulé 1 Signaux INT-upstream INT-waf-score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `POST /_next/server HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept Requête brute (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 960, "payload_entropy": 5.476719753805595, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 69, "tag_count": 11, "anomaly_count": 0, "campaign_key": "96bba2643ee81cef1b3136e389f81ef8d032a663", "event_fingerprint": "87b00af68946e45a37698a12d54984fa7e6dffe5", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 69 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "029cb63ce306b05cd213b2d2142fc25c", "path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 69 }, "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept", "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept", "evidence": { "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e520b5b1ca76dc82237b0380a071ef75bc24b14d", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%", "confidence_pct": 50, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 69 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 69, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique" }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
07/06/2026 07:34:03 UTC	TCP	3000 · HTTP	http	Prototype pollution	Élevée	Élevé · 69
Étape Tentative d'exploit MITRE TA0001 TA0001 TA0002 WAF 44 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950468:nosqli-3 Cible HTTP POST /_next/server TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /_next/server Pourquoi cette classification : Règle WAF « proto-0 » · confiance 50% Confiance classification 50% Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `POST /_next/server HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept Requête brute (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 960, "payload_entropy": 5.476719753805595, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 69, "tag_count": 11, "anomaly_count": 0, "campaign_key": "96bba2643ee81cef1b3136e389f81ef8d032a663", "event_fingerprint": "87b00af68946e45a37698a12d54984fa7e6dffe5", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 69 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "029cb63ce306b05cd213b2d2142fc25c", "path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 69 }, "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept", "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept", "evidence": { "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e520b5b1ca76dc82237b0380a071ef75bc24b14d", "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
07/06/2026 07:18:44 UTC	TCP	3000 · HTTP	http	Prototype pollution	Élevée	Élevé · 69
Étape Tentative d'exploit MITRE TA0001 TA0002 WAF 44 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950468:nosqli-3 Cible HTTP POST /_next/server TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /_next/server Pourquoi cette classification : Règle WAF « proto-0 » · confiance 50% Confiance classification 50% Tactiques MITRE TA0001 TA0002 Ligne de requête `POST /_next/server HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept Requête brute (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 960, "payload_entropy": 5.476719753805595, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 69, "tag_count": 11, "anomaly_count": 0, "campaign_key": "96bba2643ee81cef1b3136e389f81ef8d032a663", "event_fingerprint": "87b00af68946e45a37698a12d54984fa7e6dffe5", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 69 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "029cb63ce306b05cd213b2d2142fc25c", "path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 69 }, "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept", "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept", "evidence": { "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e520b5b1ca76dc82237b0380a071ef75bc24b14d", "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploit_attempt", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
06/06/2026 23:42:26 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling	Élevée	Élevé · 75
Étape Tentative d'exploit MITRE TA0001 TA0002 WAF 38 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /app TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /app Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /app HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 Payload (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x- Requête brute (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.477789822834032, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 10, "anomaly_count": 0, "campaign_key": "9a46813fe56b669239ef8573338eceb7182e5216", "event_fingerprint": "ae01e5d64c65059bfac3d910117e1109010c7099", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "7e8b2e23d5a6c8dcbfc6957a169174e1", "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "evidence": { "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d0afba983d47518dc6cdba598109bc5053fbb5ff", "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploit_attempt", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
06/06/2026 10:57:24 UTC	TCP	3000	http	Prototype pollution	Élevée	Élevé · 69
Étape Tentative d'exploit MITRE TA0001 TA0002 WAF 38 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /app TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /app Pourquoi cette classification : Règle WAF « proto-0 » · confiance 50% Confiance classification 50% Tactiques MITRE TA0001 TA0002 Ligne de requête `POST /app HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 Payload (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x- Requête brute (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.477789822834032, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 69, "tag_count": 10, "anomaly_count": 0, "campaign_key": "9a46813fe56b669239ef8573338eceb7182e5216", "event_fingerprint": "ae01e5d64c65059bfac3d910117e1109010c7099", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "7e8b2e23d5a6c8dcbfc6957a169174e1", "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe" }, "target_context": { "dst_port": 3000, "service": "http" }, "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "evidence": { "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "97528fbd34316c4e779f87e2ed517e2af4b2ea9b", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
06/06/2026 10:14:26 UTC	TCP	3000	http	Prototype pollution	Élevée	Élevé · 69
Étape Tentative d'exploit MITRE TA0001 TA0002 WAF 44 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950468:nosqli-3 Cible HTTP POST /_next/server TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /_next/server Pourquoi cette classification : Règle WAF « proto-0 » · confiance 50% Confiance classification 50% Tactiques MITRE TA0001 TA0002 Ligne de requête `POST /_next/server HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept Requête brute (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 960, "payload_entropy": 5.476719753805595, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 69, "tag_count": 11, "anomaly_count": 0, "campaign_key": "96bba2643ee81cef1b3136e389f81ef8d032a663", "event_fingerprint": "87b00af68946e45a37698a12d54984fa7e6dffe5", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "029cb63ce306b05cd213b2d2142fc25c", "path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056" }, "target_context": { "dst_port": 3000, "service": "http" }, "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept", "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept", "evidence": { "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e520b5b1ca76dc82237b0380a071ef75bc24b14d", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
06/06/2026 05:38:37 UTC	TCP	3000	http	Prototype pollution	Élevée	Élevé · 69
Étape Tentative d'exploit MITRE TA0001 TA0002 WAF 38 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /app TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /app Pourquoi cette classification : Règle WAF « proto-0 » · confiance 50% Confiance classification 50% Tactiques MITRE TA0001 TA0002 Ligne de requête `POST /app HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 Payload (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x- Requête brute (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.477789822834032, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 69, "tag_count": 10, "anomaly_count": 0, "campaign_key": "9a46813fe56b669239ef8573338eceb7182e5216", "event_fingerprint": "ae01e5d64c65059bfac3d910117e1109010c7099", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "7e8b2e23d5a6c8dcbfc6957a169174e1", "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe" }, "target_context": { "dst_port": 3000, "service": "http" }, "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "evidence": { "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "97528fbd34316c4e779f87e2ed517e2af4b2ea9b", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
06/06/2026 00:31:36 UTC	TCP	3000	http	Prototype pollution	Élevée	Élevé · 69
Étape Tentative d'exploit MITRE TA0001 TA0002 WAF 44 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950468:nosqli-3 Cible HTTP POST /_next/server TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /_next/server Pourquoi cette classification : Règle WAF « proto-0 » · confiance 50% Confiance classification 50% Tactiques MITRE TA0001 TA0002 Ligne de requête `POST /_next/server HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept Requête brute (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 960, "payload_entropy": 5.476719753805595, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 69, "tag_count": 11, "anomaly_count": 0, "campaign_key": "96bba2643ee81cef1b3136e389f81ef8d032a663", "event_fingerprint": "87b00af68946e45a37698a12d54984fa7e6dffe5", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "029cb63ce306b05cd213b2d2142fc25c", "path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056" }, "target_context": { "dst_port": 3000, "service": "http" }, "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept", "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept", "evidence": { "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e520b5b1ca76dc82237b0380a071ef75bc24b14d", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
05/06/2026 19:51:42 UTC	TCP	3000	http	Prototype pollution	Élevée	Élevé · 69
Étape Tentative d'exploit MITRE TA0001 TA0002 WAF 41 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Pourquoi cette classification : Règle WAF « proto-0 » · confiance 50% Confiance classification 50% Tactiques MITRE TA0001 TA0002 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-com Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 --0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 948, "payload_entropy": 5.478238412114009, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 69, "tag_count": 11, "anomaly_count": 0, "campaign_key": "90ea064381b843b95a563c95412ddc1b8246b652", "event_fingerprint": "ed7cd4b5808a7b0088bf2b6ff027999d206ef1c8", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "322b43884cbce88b88289e03f1f39923", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http" }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n--0", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n--0", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "12768b7b8c70ce6b12391186d3b79df72da94b53", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
05/06/2026 17:38:50 UTC	TCP	3000	http	Prototype pollution	Élevée	Élevé · 69
Étape Tentative d'exploit MITRE TA0001 TA0002 WAF 38 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /app TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /app Pourquoi cette classification : Règle WAF « proto-0 » · confiance 50% Confiance classification 50% Tactiques MITRE TA0001 TA0002 Ligne de requête `POST /app HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 Payload (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x- Requête brute (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.477789822834032, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 69, "tag_count": 10, "anomaly_count": 0, "campaign_key": "9a46813fe56b669239ef8573338eceb7182e5216", "event_fingerprint": "ae01e5d64c65059bfac3d910117e1109010c7099", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "7e8b2e23d5a6c8dcbfc6957a169174e1", "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe" }, "target_context": { "dst_port": 3000, "service": "http" }, "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "evidence": { "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "97528fbd34316c4e779f87e2ed517e2af4b2ea9b", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
05/06/2026 04:49:11 UTC	TCP	3000	http	Énumération API REST	Élevée	Élevé · 66
Étape Sonde / probe MITRE TA0007 TA0001 WAF 48 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950468:nosqli-3 Cible HTTP POST /api/route TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /api/route Pourquoi cette classification : Énumération API REST (tag sqli-4) · confiance 50% Confiance classification 50% Tactiques MITRE TA0007 TA0001 Ligne de requête `POST /api/route HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: t Requête brute (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 6 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 957, "payload_entropy": 5.474723686374105, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 66, "tag_count": 14, "anomaly_count": 0, "campaign_key": "f6d563de983650286e715f00be1695503f34423f", "event_fingerprint": "65e65f62aaa913ad704f645caea35cffc912e98f", "classification_reason": "\u00c9num\u00e9ration API REST (tag sqli-4) \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 65, "precision_signals": [ "INT-upstream", "INT-api-probe-generic" ], "kb_rule_ids": [ "INT-upstream", "INT-api-probe-generic" ], "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "b9bd2f4cfa8bd354105cbdc2b2908e9d", "path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32" }, "target_context": { "dst_port": 3000, "service": "http" }, "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: t", "method": "POST", "path": "\/api\/route", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api\/route HTTP\/1.1", "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 6", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: t", "evidence": { "method": "POST", "path": "\/api\/route", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api\/route HTTP\/1.1", "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 6", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: t", "classification_reason": "\u00c9num\u00e9ration API REST (tag sqli-4) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b663c61a98e634c5e9ca4fa3edd6b7fabf29ca22", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_api_route_probe", "http_contenttype_attack_surface", "http_jwt_body", "http_probe_api", "http_prototype_pollution", "net_web_probe" ] }
05/06/2026 03:25:54 UTC	TCP	3000	http	Prototype pollution	Élevée	Élevé · 69
Étape Tentative d'exploit MITRE TA0001 TA0002 WAF 38 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /_next TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /_next Pourquoi cette classification : Règle WAF « proto-0 » · confiance 50% Confiance classification 50% Tactiques MITRE TA0001 TA0002 Ligne de requête `POST /_next HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/ Requête brute (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 953, "payload_entropy": 5.477328163409766, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 69, "tag_count": 10, "anomaly_count": 0, "campaign_key": "9a46813fe56b669239ef8573338eceb7182e5216", "event_fingerprint": "c49bbffea35129d829a515ff116f95c1704735dd", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%", "confidence": 0.5, "classification_confidence": 0.5, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "5b518f89b56a28e8155688621f409997", "path_pattern_hash": "bfd33612e3863357684bd23d10455a76" }, "target_context": { "dst_port": 3000, "service": "http" }, "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/", "method": "POST", "path": "\/_next", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next HTTP\/1.1", "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/", "evidence": { "method": "POST", "path": "\/_next", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next HTTP\/1.1", "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/", "classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4d6a72c980ff75d4c9a7539437ede467a89762b2", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body", "http_prototype_pollution", "net_web_probe" ] }
04/06/2026 21:03:48 UTC	TCP	3000	http	SSRF interne	Élevée	Élevé · 71
Étape Tentative d'exploit MITRE TA0001 TA0002 WAF 42 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /api TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /api Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 58% Confiance classification 58% Tactiques MITRE TA0001 TA0002 Motifs de détection (base) DB-ssrf-0292 Ligne de requête `POST /api HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF sqli-4 rce-0 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x- Requête brute (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-component Next-Action: x Content-Type: multipart/form-data; boundary=0fdf55df9e085737676f582ed4e95a02 Content-Length: 695 Meta JSON brut { "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.477458672522051, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 80, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 71, "tag_count": 11, "anomaly_count": 0, "campaign_key": "9a84641f95332d9716ee02a2cfb37a0f39425d93", "event_fingerprint": "4f99a7d92fe1c1e77fc3a3c563d97b11b0619181", "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 58%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 69, "precision_signals": [ "DB-ssrf-0292" ], "kb_rule_ids": [ "DB-ssrf-0292" ], "matched_patterns": [ "DB-ssrf-0292" ], "matched_pattern_names": [ "DB-ssrf-0292" ], "classification_parent": "ssrf_attack", "risk_confidence_factor": 58, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "c6d347dfc6c60be4890e9a77d1231733", "path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221" }, "target_context": { "dst_port": 3000, "service": "http" }, "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "evidence": { "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (rondo2012@atomicmail.io)", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-component\r\nNext-Action: x\r\nContent-Type: multipart\/form-data; boundary=0fdf55df9e085737676f582ed4e95a02\r\nContent-Length: 695\r\n\r\n", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 58%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5044346a57842999fc94ff55023bd493f7913215", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_contenttype_attack_surface", "http_jwt_body", "http_probe_api", "http_prototype_pollution" ] }
04/06/2026 14:07:31 UTC	TCP	3000	http	web attack	Élevée	Élevé · 65
Étape Tentative d'exploit MITRE TA0001 TA0002 WAF 48 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950468:nosqli-3 Cible HTTP POST /api/route TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /api/route Confiance classification 100% Tactiques MITRE TA0001 TA0002 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF 950019:sqli-4 950326:rce-0 950327:rce-0 950468:nosqli-3 950471:nosqli-3 950493:proto-0 950549:upload-0 950600:k8s-api Payload (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: t Meta JSON brut { "http_header_count": 7, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 957, "payload_entropy": 5.474723686374105, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 100, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 100, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 65, "tag_count": 11, "anomaly_count": 0, "campaign_key": "467de5788c88bb68076b2f0fbfe0feb7c4e5dd6f", "event_fingerprint": "c49c13ab95b8dcb466553405b9993e7e27e55cdb", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "b9bd2f4cfa8bd354105cbdc2b2908e9d", "path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32" }, "target_context": { "dst_port": 3000, "service": "http" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "threat_family": [ "unknown" ], "confidence": 1, "classification_confidence": 1, "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: t", "event_signature": "181f9b8617586a7be89a416a97610f2f09d590c0", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_contenttype_attack_surface", "http_jwt_body", "http_probe_api" ] }
04/06/2026 06:14:31 UTC	TCP	3000	http	web attack	Élevée	Élevé · 65
Étape Tentative d'exploit MITRE TA0001 TA0002 WAF 38 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /app TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /app Confiance classification 100% Tactiques MITRE TA0001 TA0002 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 950493:proto-0 950549:upload-0 Payload (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x- Meta JSON brut { "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.477789822834032, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 100, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.6, "risk_breakdown": { "waf": 100, "classification": 100, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 65, "tag_count": 8, "anomaly_count": 0, "campaign_key": "c0da2de6402b95e491d6fb944a5be5e204ceba08", "event_fingerprint": "9434400c4aecded381b24d5a44d87483e1bc631c", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "7e8b2e23d5a6c8dcbfc6957a169174e1", "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe" }, "target_context": { "dst_port": 3000, "service": "http" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "threat_family": [ "unknown" ], "confidence": 1, "classification_confidence": 1, "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-", "event_signature": "5fe56c3f56af128b554726e780fde6fe2c162470", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body" ] }
04/06/2026 04:44:40 UTC	TCP	3000	http	web attack	Élevée	Élevé · 65
Étape Tentative d'exploit MITRE TA0001 TA0002 WAF 41 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Confiance classification 100% Tactiques MITRE TA0001 TA0002 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 950493:proto-0 950549:upload-0 950734:sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: text/x-com Meta JSON brut { "http_header_count": 7, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 948, "payload_entropy": 5.478238412114009, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 100, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 100, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 65, "tag_count": 9, "anomaly_count": 0, "campaign_key": "37e6d9b17bed0926d1279d6e3f23985eaeb94dc5", "event_fingerprint": "0a214565a1a673fa2b423a6100124922e6892757", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "322b43884cbce88b88289e03f1f39923", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "threat_family": [ "unknown" ], "confidence": 1, "classification_confidence": 1, "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: text\/x-com", "event_signature": "8c453d776f7241afe015752fda65adb47a46fab1", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path", "http_contenttype_attack_surface", "http_jwt_body" ] }
03/06/2026 20:59:49 UTC	TCP	3000	http	web attack	Élevée	Élevé · 65
Étape Tentative d'exploit MITRE TA0001 TA0002 WAF 48 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950468:nosqli-3 Cible HTTP POST /api/route TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /api/route Confiance classification 100% Tactiques MITRE TA0001 TA0002 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF 950019:sqli-4 950326:rce-0 950327:rce-0 950468:nosqli-3 950471:nosqli-3 950493:proto-0 950549:upload-0 950600:k8s-api Payload (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 (rondo2012@atomicmail.io) Connection: close Accept: t Meta JSON brut { "http_header_count": 7, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 957, "payload_entropy": 5.474723686374105, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "dst_port": 3000, "risk_waf": 100, "risk_classification": 100, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 100, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 65, "tag_count": 11, "anomaly_count": 0, "campaign_key": "467de5788c88bb68076b2f0fbfe0feb7c4e5dd6f", "event_fingerprint": "c49c13ab95b8dcb466553405b9993e7e27e55cdb", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 210558, "org": "1337 Services GmbH", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9005dbd9ffec50c97df2497ce59ea991", "payload_hash": "b9bd2f4cfa8bd354105cbdc2b2908e9d", "path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32" }, "target_context": { "dst_port": 3000, "service": "http" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "threat_family": [ "unknown" ], "confidence": 1, "classification_confidence": 1, "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0 (rondo2012@atomicmail.io)\r\nConnection: close\r\nAccept: t", "event_signature": "181f9b8617586a7be89a416a97610f2f09d590c0", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_contenttype_attack_surface", "http_jwt_body", "http_probe_api" ] }
01/06/2026 18:35:03 UTC	TCP	3000	http	web attack	Élevée	Critique · 100
Étape — WAF 38 Recommandation — Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /_next TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /_next Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 950493:proto-0 950549:upload-0 Meta JSON brut { "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 953, "payload_entropy": 5.477328163409766, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "tag_count": 8, "anomaly_count": 0, "risk_score": 100, "campaign_key": "c0da2de6402b95e491d6fb944a5be5e204ceba08", "event_fingerprint": "c5bdee8ada8d10d23c51954cc145e572e92ee340", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body" ] }
01/06/2026 14:17:34 UTC	TCP	3000	http	web attack	Élevée	Critique · 100
Étape — WAF 38 Recommandation — Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /_next TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /_next Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 950493:proto-0 950549:upload-0 Meta JSON brut { "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 953, "payload_entropy": 5.477328163409766, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "tag_count": 8, "anomaly_count": 0, "risk_score": 100, "campaign_key": "c0da2de6402b95e491d6fb944a5be5e204ceba08", "event_fingerprint": "c5bdee8ada8d10d23c51954cc145e572e92ee340", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body" ] }
01/06/2026 13:04:27 UTC	TCP	3000	http	web attack	Élevée	Critique · 100
Étape — WAF 48 Recommandation — Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950468:nosqli-3 Cible HTTP POST /api/route TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /api/route Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF 950019:sqli-4 950326:rce-0 950327:rce-0 950468:nosqli-3 950471:nosqli-3 950493:proto-0 950549:upload-0 950600:k8s-api Meta JSON brut { "http_header_count": 7, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 957, "payload_entropy": 5.474723686374105, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "tag_count": 11, "anomaly_count": 0, "risk_score": 100, "campaign_key": "467de5788c88bb68076b2f0fbfe0feb7c4e5dd6f", "event_fingerprint": "c49c13ab95b8dcb466553405b9993e7e27e55cdb", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_contenttype_attack_surface", "http_jwt_body", "http_probe_api" ] }
01/06/2026 10:36:13 UTC	TCP	3000	http	web attack	Élevée	Critique · 100
Étape — WAF 41 Recommandation — Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 950493:proto-0 950549:upload-0 950734:sap-sapcontrol-path Meta JSON brut { "http_header_count": 7, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 948, "payload_entropy": 5.478238412114009, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "tag_count": 9, "anomaly_count": 0, "risk_score": 100, "campaign_key": "37e6d9b17bed0926d1279d6e3f23985eaeb94dc5", "event_fingerprint": "0a214565a1a673fa2b423a6100124922e6892757", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path", "http_contenttype_attack_surface", "http_jwt_body" ] }
01/06/2026 09:10:24 UTC	TCP	3000	http	web attack	Élevée	Critique · 100
Étape — WAF 41 Recommandation — Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 950493:proto-0 950549:upload-0 950734:sap-sapcontrol-path Meta JSON brut { "http_header_count": 7, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 948, "payload_entropy": 5.478238412114009, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "tag_count": 9, "anomaly_count": 0, "risk_score": 100, "campaign_key": "37e6d9b17bed0926d1279d6e3f23985eaeb94dc5", "event_fingerprint": "0a214565a1a673fa2b423a6100124922e6892757", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path", "http_contenttype_attack_surface", "http_jwt_body" ] }
01/06/2026 00:05:58 UTC	TCP	3000	http	web attack	Élevée	Critique · 100
Étape — WAF 38 Recommandation — Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /app TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /app Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 950493:proto-0 950549:upload-0 Meta JSON brut { "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.477789822834032, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "tag_count": 8, "anomaly_count": 0, "risk_score": 100, "campaign_key": "c0da2de6402b95e491d6fb944a5be5e204ceba08", "event_fingerprint": "9434400c4aecded381b24d5a44d87483e1bc631c", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body" ] }
31/05/2026 23:38:58 UTC	TCP	3000	http	web attack	Élevée	Critique · 100
Étape — WAF 42 Recommandation — Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /api TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /api Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 950493:proto-0 950549:upload-0 950600:k8s-api Meta JSON brut { "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.477458672522051, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "tag_count": 10, "anomaly_count": 0, "risk_score": 100, "campaign_key": "e49195bce497c65c06941e6ef27785bb42dafe40", "event_fingerprint": "8f28b75b15a449a81db05f356f3f02b57bdaf25d", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_contenttype_attack_surface", "http_jwt_body", "http_probe_api" ] }
31/05/2026 18:49:21 UTC	TCP	3000	http	web attack	Élevée	Critique · 100
Étape — WAF 38 Recommandation — Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /_next TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /_next Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 950493:proto-0 950549:upload-0 Meta JSON brut { "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 953, "payload_entropy": 5.477328163409766, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "tag_count": 8, "anomaly_count": 0, "risk_score": 100, "campaign_key": "c0da2de6402b95e491d6fb944a5be5e204ceba08", "event_fingerprint": "c5bdee8ada8d10d23c51954cc145e572e92ee340", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_jwt_body" ] }
31/05/2026 14:37:41 UTC	TCP	3000	http	web attack	Élevée	Critique · 100
Étape — WAF 42 Recommandation — Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /api TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /api Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 950493:proto-0 950549:upload-0 950600:k8s-api Meta JSON brut { "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.477458672522051, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "tag_count": 10, "anomaly_count": 0, "risk_score": 100, "campaign_key": "e49195bce497c65c06941e6ef27785bb42dafe40", "event_fingerprint": "8f28b75b15a449a81db05f356f3f02b57bdaf25d", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_contenttype_attack_surface", "http_jwt_body", "http_probe_api" ] }
30/05/2026 23:58:36 UTC	TCP	3000	http	web attack	Élevée	Critique · 100
Étape — WAF 42 Recommandation — Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 Cible HTTP POST /api TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible /api Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (rondo2012@atomicmail.io) Règles WAF 950019:sqli-4 950326:rce-0 950327:rce-0 950471:nosqli-3 950493:proto-0 950549:upload-0 950600:k8s-api Meta JSON brut { "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "eba3844e9fd20716239bb97530c41d30bf39a871", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 951, "payload_entropy": 5.477458672522051, "port_category": "registered", "org": "1337 Services GmbH", "service": "http", "app_proto": "http", "asn": 210558, "country": "US", "tag_count": 10, "anomaly_count": 0, "risk_score": 100, "campaign_key": "e49195bce497c65c06941e6ef27785bb42dafe40", "event_fingerprint": "8f28b75b15a449a81db05f356f3f02b57bdaf25d", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950471:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_contenttype_attack_surface", "http_jwt_body", "http_probe_api" ] }

124.198.131.39

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence