Renseignement sur les menaces

Slovénie

130.12.182.110

FAI VPS Dedicated LLC Première vue 05/07/2026 08:44 UTC Dernière vue 18/07/2026 02:41 UTC Risque Moyen

Période analysée : 2026-07-11 → 2026-07-18

Activité suspecte — risque 50/100 (Moyen) — MITRE T1046 — confiance 100 % — via SSH

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 50/100 Moyen

Première observation 05/07/2026 08:44 UTC

Dernière observation 18/07/2026 02:41 UTC

Événements (période) 100

MITRE ATT&CK principal TA0007 104 occurrences

Activité suspecte — risque 50/100 (Moyen) — MITRE T1046 — confiance 100 % — via SSH

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Bannière client SSH reçue · confiance 100%

Confiance 100 % — Score WAF 8

Comparaison ASN / FAI

ASN 197769 · 130.12.182.0/24 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 100 événements sur la période pour cette IP.

102.220.160.29 Sonde port 18/07/2026 10:07 UTC
130.12.182.107 Sonde port 18/07/2026 05:30 UTC
102.220.160.26 Sonde SSH 18/07/2026 04:04 UTC
102.220.160.39 Sonde SSH 18/07/2026 03:53 UTC
102.220.160.67 Sonde SSH 18/07/2026 02:37 UTC
130.12.182.98 Sonde SSH 18/07/2026 02:36 UTC
102.220.160.47 Flood / DDoS 17/07/2026 07:25 UTC
102.220.160.41 Sonde HTTP 16/07/2026 13:26 UTC

Événements (filtres)

100

Première observation

05/07/2026 08:44 UTC

Dernière observation

18/07/2026 02:41 UTC

Dernière activité (filtres)

18/07/2026 02:41 UTC

Événements 7j

100

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 57 HTTPS TCP 16 HDFS NAMENODE TCP 8 SSH TCP 6 SOCKS5 TCP 4 SAP ICM TCP 2 HTTP ALT 8090 TCP 1

HTTP

HTTPS

HDFS NAMENODE

SSH

SOCKS5

SAP ICM

Géolocalisation

Origine réseau déclarée

Slovénie unknown unknown

FAI / réseau

Opérateur et dernière activité ban

VPS Dedicated LLC 0 Port 22 ssh_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

Sonde SSH · via SSH:22 · (sonde / probe)

Détails protocole

Bannière SSH: SSH-2.0-libssh_0.11.4 lF�ߞ�B1�E#�%��hcurve25519-sha256,curve25519-sha…

Aperçu payload

SSH-2.0-libssh_0.11.4 lF�ߞ�B1�E#�%��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis

Port / service

22 · SSH

Service émulé

SSH

Raison confiance

Confiance 100 % — Motif catalogue confirmé

Technique MITRE

T1046

Persona capteur

mail.sensor-1.internal

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

Client SSH libssh/paramiko (scanner) pat-0391 pat-0392 Upstream

Confiance

100%

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

100 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

100 événement(s) — page 1/2

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
18/07/2026 02:41:43 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-libssh_0.11.4 lF�ߞ�B1�E#�%��hcurve25519-sha25… Émulateur SSH WAF — Recommandation Investiguer Tags net_ssh_probe ssh_banner ssh_emulated ssh_kex_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-libssh_0.11.4 lF�ߞ�B1�E#�%��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-s… Payload SSH-2.0-libssh_0.11.4 lF�ߞ�B1�E#�%��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0391 pat-0392 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) SSH-2.0 banner RFC4253 libssh banner TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-libssh_0.11.4 lF�ߞ�B1�E#�%��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis Requête brute (extrait) SSH-2.0-libssh_0.11.4 lF�ߞ�B1�E#�%��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a", "emulator_response_len": 40, "bytes_in": 1159, "payload_entropy": 4.8402524068578625, "port_category": "well_known", "org": "VPS Dedicated LLC", "service": "ssh", "app_proto": "ssh", "asn": 197769, "country": "SI", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0391", "pat-0392", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0391", "pat-0392", "INT-upstream" ], "matched_patterns": [ "pat-0391", "pat-0392", "pat-0536" ], "matched_pattern_names": [ "SSH-2.0 banner RFC4253", "libssh banner", "TFTP RRQ" ], "pattern_ids": [ "pat-0391", "pat-0392", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 25, "risk_score": 50 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4738917803b59eb71c9543caf50e6bef", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014F\ufffd\u07de\ufffdB1\ufffdE#\ufffd\u001b%\ufffd\u001b\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014F\ufffd\u07de\ufffdB1\ufffdE#\ufffd\u001b%\ufffd\u001b\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie", "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014F\ufffd\u07de\ufffdB1\ufffdE#\ufffd\u001b%\ufffd\u001b\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "evidence": { "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014F\ufffd\u07de\ufffdB1\ufffdE#\ufffd\u001b%\ufffd\u001b\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie", "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014F\ufffd\u07de\ufffdB1\ufffdE#\ufffd\u001b%\ufffd\u001b\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ff98f80ac1754489e4acf63cceae1af3e4c5a753", "protocol_details": { "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014F\ufffd\u07de\ufffdB1\ufffdE#\ufffd\u001b%\ufffd\u001b\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014F\ufffd\u07de\ufffdB1\ufffdE#\ufffd\u001b%\ufffd\u001b\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nlF\ufffd\u07de\ufffdB1\ufffdE#\ufffd%\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 25, "risk_score": 50 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0391", "pat-0392", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0391", "pat-0392", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014F\ufffd\u07de\ufffdB1\ufffdE#\ufffd\u001b%\ufffd\u001b\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014F\ufffd\u07de\ufffdB1\ufffdE#\ufffd\u001b%\ufffd\u001b\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nlF\ufffd\u07de\ufffdB1\ufffdE#\ufffd%\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ], "asn_dc_heuristic": true }
17/07/2026 07:35:35 UTC	TCP	8000 · SAP ICM	sap-icm	Flood / DDoS http flood · via SAP ICM:8000 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur SAP-ICM WAF — Recommandation Surveiller Tags net_sap_web_probe sap_icm_emulated sap_icm_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8000 Chemin / cible — Service SAP ICM Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic dXNlcjoxMjM0NQ== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic dXNlcjoxMjM0NQ== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c", "emulator_response_len": 141, "bytes_in": 106, "payload_entropy": 4.985477523250889, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "sap-icm", "app_proto": "sap-icm", "asn": 197769, "country": "SI", "dst_port": 8000, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 38, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 38, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc", "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 38, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "sap-icm", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bd2c4244ce7541e61fd27adaafed34f1", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8000, "service": "sap-icm", "service_name": "sap-icm", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NQ==\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NQ==\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NQ==", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NQ==\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NQ==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3d75501ff0797f2ca7760889a5eadbef93273015", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NQ==", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NQ==", "attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via SAP ICM", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 38, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "sap-icm", "service_label_fr": "SAP ICM", "dst_port": 8000, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-icm", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NQ==", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NQ==", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_icm", "service_banner": "honeypot-sap-icm", "service_os": "linux", "dst_port": "8000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "net_sap_web_probe", "sap_icm_emulated", "sap_icm_payload" ], "asn_dc_heuristic": true }
17/07/2026 07:35:29 UTC	TCP	8000 · SAP ICM	sap-icm	Flood / DDoS http flood · via SAP ICM:8000 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur SAP-ICM WAF — Recommandation Surveiller Tags net_sap_web_probe sap_icm_emulated sap_icm_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8000 Chemin / cible — Service SAP ICM Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic ZnJhcHBlOmZyYXBwZTEy Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic ZnJhcHBlOmZyYXBwZTEy Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c", "emulator_response_len": 141, "bytes_in": 112, "payload_entropy": 5.044000616689439, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "sap-icm", "app_proto": "sap-icm", "asn": 197769, "country": "SI", "dst_port": 8000, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 38, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 38, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc", "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 38, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "sap-icm", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "13522f43326f416497fd6f59774e91d8", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8000, "service": "sap-icm", "service_name": "sap-icm", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ZnJhcHBlOmZyYXBwZTEy\r\n\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ZnJhcHBlOmZyYXBwZTEy\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ZnJhcHBlOmZyYXBwZTEy", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ZnJhcHBlOmZyYXBwZTEy\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ZnJhcHBlOmZyYXBwZTEy", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b9f82144d5ff1ca6f4b7a5057016af6d97a0b0ce", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ZnJhcHBlOmZyYXBwZTEy", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ZnJhcHBlOmZyYXBwZTEy", "attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via SAP ICM", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 38, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "sap-icm", "service_label_fr": "SAP ICM", "dst_port": 8000, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-sap-icm", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ZnJhcHBlOmZyYXBwZTEy", "port": 8000, "service": "sap-icm", "service_label_fr": "SAP ICM" }, "attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ZnJhcHBlOmZyYXBwZTEy", "target_port_label": "8000 \u00b7 SAP ICM", "emulator_service": "sap-icm", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "sap_icm", "service_banner": "honeypot-sap-icm", "service_os": "linux", "dst_port": "8000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "net_sap_web_probe", "sap_icm_emulated", "sap_icm_payload" ], "asn_dc_heuristic": true }
16/07/2026 12:14:43 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 130.12.182.110:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 130.12.182.110:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 130.12.182.110:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 130.12.182.110:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 130.12.182.110:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "110:80", "http_ua_hash": null, "http_host_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_target_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 4.958151136909007, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "34593eb7a9ade68b18c340109b848dcb8dffed4c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3484653134406fa05b0a1abeb9648c84", "path_pattern_hash": "0597d3f76c01271498156690f9e0137d" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n", "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "evidence": { "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "67b70ab6992af92043912b1fb76ebfd79b5c6f28", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
16/07/2026 10:30:36 UTC	TCP	8090 · HTTP ALT 8090	http-alt-8090	http-alt-8090 http-alt-8090 · via HTTP ALT 8090:8090 · (sonde / probe)	Faible	Faible · 3
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur HTTP-ALT-8090 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8090 Chemin / cible — Service HTTP ALT 8090 Pourquoi cette classification : Type « http-alt-8090 » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 3 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http-alt-8090", "app_proto": "http-alt-8090", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 40, "protocol": 22, "novelty": 0 }, "risk_score": 3, "tag_count": 0, "anomaly_count": 0, "campaign_key": "074fcf7b6621f792f12eafd4c85696050ae26041", "event_fingerprint": "73de1024b23993e40693db328fc9a5b5266e5167", "classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 40, "protocol": 22, "novelty": 0, "risk_score": 3 }, "named_classification_skipped": false, "service_name": "http-alt-8090", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "ced820066cc8b42921bb5be056af57a9" }, "target_context": { "dst_port": 8090, "service": "http-alt-8090", "service_name": "http-alt-8090", "risk_score": 3 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1ca906e7588cc1b86ee9225c7c11e40f3d44efb1", "protocol_details": { "port": 8090, "service": "http-alt-8090", "service_label_fr": "HTTP ALT 8090" }, "attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)", "target_port_label": "8090 \u00b7 HTTP ALT 8090", "emulator_service": "http-alt-8090", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab http-alt-8090 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 40, "protocol": 22, "novelty": 0, "risk_score": 3 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 3, "risk_label": "Faible", "service_name": "http-alt-8090", "service_label_fr": "HTTP ALT 8090", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http-alt-8090", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 8090, "service": "http-alt-8090", "service_label_fr": "HTTP ALT 8090" }, "attack_vector": "http-alt-8090 \u00b7 via HTTP ALT 8090:8090 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "8090 \u00b7 HTTP ALT 8090", "emulator_service": "http-alt-8090", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http_alt_8090", "service_banner": "honeypot-http-alt-8090", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
16/07/2026 10:16:21 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 130.12.182.110:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 130.12.182.110:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 130.12.182.110:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 130.12.182.110:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 130.12.182.110:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic MTIzNDU6MTIzNDU= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "110:80", "http_ua_hash": null, "http_host_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_target_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 4.969897481228219, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "34593eb7a9ade68b18c340109b848dcb8dffed4c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "fcd6a3ef6e0cb398436320b43b04bc0d", "path_pattern_hash": "0597d3f76c01271498156690f9e0137d" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n", "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "evidence": { "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "90f7c22b46439fa453e8c4e36aaa4de2d8adc93e", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
16/07/2026 07:25:42 UTC	TCP	8090 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 130.12.182.110:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 130.12.182.110:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 130.12.182.110:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8090 Chemin / cible 130.12.182.110:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 130.12.182.110:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "110:80", "http_ua_hash": null, "http_host_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_target_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 4.957797014505901, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8090, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794", "event_fingerprint": "34593eb7a9ade68b18c340109b848dcb8dffed4c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f197546faa9a59a07990e19106a2c183", "path_pattern_hash": "0597d3f76c01271498156690f9e0137d" }, "service_name": "http", "target_context": { "dst_port": 8090, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "evidence": { "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fe2846edae49801f278915d52713a185bccd8cdc", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8090, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8090, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "target_port_label": "8090 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8090" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 19:05:26 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 130.12.182.110:80 HTTP/1.0 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 36, "payload_entropy": 3.8847954873731334, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7e61442349aaac06ced7a04833c4183f", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4b34045f32fccace119ec8a0e4381e53e86dc4ab", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 0, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 19:01:31 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic dXNlcjE6cGFzczE= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic dXNlcjE6cGFzczE= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 106, "payload_entropy": 5.0203218016805415, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9705f36c781f13a4f11d7eddaff0a75b", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "42faed3356b5d249d5fb1ecf31d51bdf313051cd", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 18:57:10 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic cm9vdDo1TUpLMHdIbGljR0hzd0FvU2w= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic cm9vdDo1TUpLMHdIbGljR0hzd0FvU2w= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 122, "payload_entropy": 5.270420895658552, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "22ae55f2a2adccadb0b4f505324d1b8e", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo1TUpLMHdIbGljR0hzd0FvU2w=\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo1TUpLMHdIbGljR0hzd0FvU2w=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo1TUpLMHdIbGljR0hzd0FvU2w=", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo1TUpLMHdIbGljR0hzd0FvU2w=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo1TUpLMHdIbGljR0hzd0FvU2w=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "de5483f347d30a8777ad125a9ce0b47e310db337", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo1TUpLMHdIbGljR0hzd0FvU2w=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo1TUpLMHdIbGljR0hzd0FvU2w=", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HDFS NAMENODE \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo1TUpLMHdIbGljR0hzd0FvU2w=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo1TUpLMHdIbGljR0hzd0FvU2w=", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "hdfs-namenode", "ssh" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 18:53:11 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic aGRtOmhkbQ== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic aGRtOmhkbQ== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 104, "payload_entropy": 4.977064528768555, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ea90ecb5d27aa87b127f37ad9dc6e412", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic aGRtOmhkbQ==\r\n\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic aGRtOmhkbQ==\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic aGRtOmhkbQ==", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic aGRtOmhkbQ==\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic aGRtOmhkbQ==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fb508941e55b00b9f25e1c1f8da56e199db6b66a", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic aGRtOmhkbQ==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic aGRtOmhkbQ==", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HDFS NAMENODE \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic aGRtOmhkbQ==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic aGRtOmhkbQ==", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "hdfs-namenode", "ssh" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 18:52:36 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-libssh_0.11.4 l8��0=��Ȣ�u��hcurve25519-sha256… Émulateur SSH WAF — Recommandation Investiguer Tags net_ssh_probe ssh_banner ssh_emulated ssh_kex_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-libssh_0.11.4 l8��0=��Ȣ�u��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sh… Payload SSH-2.0-libssh_0.11.4 l8��0=��Ȣ�u��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0391 pat-0392 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) SSH-2.0 banner RFC4253 libssh banner Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-libssh_0.11.4 l8��0=��Ȣ�u��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis Requête brute (extrait) SSH-2.0-libssh_0.11.4 l8��0=��Ȣ�u��hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a", "emulator_response_len": 32, "bytes_in": 1159, "payload_entropy": 4.828038287775053, "port_category": "well_known", "org": "VPS Dedicated LLC", "service": "ssh", "app_proto": "ssh", "asn": 197769, "country": "SI", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0391", "pat-0392", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0391", "pat-0392", "INT-upstream" ], "matched_patterns": [ "pat-0391", "pat-0392", "pat-0554", "pat-0536" ], "matched_pattern_names": [ "SSH-2.0 banner RFC4253", "libssh banner", "Minecraft varint handshake", "TFTP RRQ" ], "pattern_ids": [ "pat-0391", "pat-0392", "pat-0554", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 25, "risk_score": 50, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5439c9a7c9cdfe2f044afeee4da35cbc", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u00148\ufffd\ufffd0=\ufffd\ufffd\u0222\ufffdu\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u00148\ufffd\ufffd0=\ufffd\ufffd\u0222\ufffdu\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie", "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u00148\ufffd\ufffd0=\ufffd\ufffd\u0222\ufffdu\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "evidence": { "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u00148\ufffd\ufffd0=\ufffd\ufffd\u0222\ufffdu\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie", "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u00148\ufffd\ufffd0=\ufffd\ufffd\u0222\ufffdu\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5b1ef5158c3d439ef5cdc7d1fc7ae2fa93447ad9", "protocol_details": { "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u00148\ufffd\ufffd0=\ufffd\ufffd\u0222\ufffdu\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u00148\ufffd\ufffd0=\ufffd\ufffd\u0222\ufffdu\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl8\ufffd\ufffd0=\ufffd\ufffd\u0222\ufffdu\ufffd\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 25, "risk_score": 50, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0391", "pat-0392", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0391", "pat-0392", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u00148\ufffd\ufffd0=\ufffd\ufffd\u0222\ufffdu\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u00148\ufffd\ufffd0=\ufffd\ufffd\u0222\ufffdu\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl8\ufffd\ufffd0=\ufffd\ufffd\u0222\ufffdu\ufffd\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "hdfs-namenode", "ssh" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ], "asn_dc_heuristic": true }
15/07/2026 18:49:17 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	hdfs probe hdfs probe · via HDFS NAMENODE:8020 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic c3F1aWQ6c3F1aWQ= Pourquoi cette classification : Type « hdfs_probe » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 34 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic c3F1aWQ6c3F1aWQ= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 108, "payload_entropy": 4.902684949128919, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 34, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab hdfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0.08, "classification_confidence": 0.08, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 34, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "dcac623c1491472146146cc41c68148a", "path_pattern_hash": "504871b8907d47c47e0e5eef0ff043b4" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 34 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic c3F1aWQ6c3F1aWQ=\r\n\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic c3F1aWQ6c3F1aWQ=\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic c3F1aWQ6c3F1aWQ=", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic c3F1aWQ6c3F1aWQ=\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic c3F1aWQ6c3F1aWQ=", "classification_reason": "Type \u00ab hdfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b03b73c4bffb38f62ee31c5a1e81b83113bf27e2", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic c3F1aWQ6c3F1aWQ=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic c3F1aWQ6c3F1aWQ=", "attack_vector": "hdfs probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab hdfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab hdfs_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 8, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 34, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic c3F1aWQ6c3F1aWQ=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "hdfs probe \u00b7 via HDFS NAMENODE:8020 \u00b7 (sonde \/ probe)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic c3F1aWQ6c3F1aWQ=", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "hdfs-namenode", "http", "ssh" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 18:46:19 UTC	TCP	2525 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:2525 · (sonde / probe)	Élevée	Moyen · 48
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-libssh_0.11.4 Émulateur SSH WAF — Recommandation Surveiller Tags ssh_banner ssh_libssh Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2525 Chemin / cible — Service SSH Bannière SSH SSH-2.0-libssh_0.11.4 Payload SSH-2.0-libssh_0.11.4 Pourquoi cette classification : Bannière client SSH reçue · confiance 95% Confiance classification 95% Risque capteur Moyen · 48 Confiance : Confiance 95 % — 2 signal(aux) capteur Signaux Client SSH libssh/paramiko (scanner) Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-libssh_0.11.4 Meta JSON brut { "bytes_in": 23, "payload_entropy": 3.8820451081368628, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "ssh", "app_proto": "ssh", "asn": 197769, "country": "SI", "dst_port": 2525, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0 }, "risk_score": 48, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c39e8ccf813c56df4d79c64bebc0b1bc7a1d0d45", "event_fingerprint": "fbcd176559a24e0470ce268b04406fa70b0b470d", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 79, "precision_signals": [ "INT-ssh-libssh-ua", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "INT-upstream" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0, "risk_score": 48 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 95, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "23207ccc4239238861ca89024fcc4096", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 2525, "service": "ssh", "service_name": "ssh", "risk_score": 48 }, "payload_preview": "SSH-2.0-libssh_0.11.4\r\n", "request_sample": "SSH-2.0-libssh_0.11.4\r\n", "payload_snippet": "SSH-2.0-libssh_0.11.4", "evidence": { "request_sample": "SSH-2.0-libssh_0.11.4\r\n", "payload_snippet": "SSH-2.0-libssh_0.11.4", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c1cf79399bd5c3de4143b6485d13e371c89ad978", "protocol_details": { "ssh_banner": "SSH-2.0-libssh_0.11.4", "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "SSH-2.0-libssh_0.11.4", "port": 2525, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-libssh_0.11.4", "attack_vector": "Sonde SSH \u00b7 via SSH:2525 \u00b7 (sonde \/ probe)", "target_port_label": "2525 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 95 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0, "risk_score": 48 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 48, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 2525, "protocol_emulated": null, "tags_summary": [ "INT-ssh-libssh-ua", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "Upstream" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ssh_banner": "SSH-2.0-libssh_0.11.4", "smtp_auth_fr": "Sonde protocole SMTP", "payload_preview": "SSH-2.0-libssh_0.11.4", "port": 2525, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:2525 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-libssh_0.11.4", "target_port_label": "2525 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 95 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "ssh_banner", "ssh_libssh" ], "asn_dc_heuristic": true }
15/07/2026 18:46:19 UTC	TCP	2525 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:2525 · (sonde / probe) · → 130.12.182.110:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 130.12.182.110:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 130.12.182.110:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 2525 Chemin / cible 130.12.182.110:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 130.12.182.110:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic dXNlcjoxMjM0NTZAYWJj Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "110:80", "http_ua_hash": null, "http_host_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_target_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.046737281747089, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 2525, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "6c54bd910ca0fbd9d349af327b8027c451b2c8d8", "event_fingerprint": "5b2582a075c9875e3f33c98204a7e98a85de1891", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "52b1f776366281d25f7855bf766d7eb4", "path_pattern_hash": "0597d3f76c01271498156690f9e0137d" }, "service_name": "http", "target_context": { "dst_port": 2525, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NTZAYWJj\r\n\r\n", "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NTZAYWJj\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NTZAYWJj", "evidence": { "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NTZAYWJj\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NTZAYWJj", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1feda004d1e893f38df71b89c57337c8d49a2027", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NTZAYWJj", "attack_vector": "Sonde HTTP \u00b7 via HTTP:2525 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2525, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "smtp_auth_fr": "Sonde protocole SMTP", "port": 2525, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:2525 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NTZAYWJj", "target_port_label": "2525 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2525" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "ssh" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
15/07/2026 18:30:19 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 130, "payload_entropy": 5.2795642993511205, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ace8cc15579821f600baffd15b1324ec", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d837a024d16ae4c832fd054583bf200587af85d3", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 18:26:47 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic cm9vdDpyb290LXJvb3Q= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic cm9vdDpyb290LXJvb3Q= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 112, "payload_entropy": 5.1292829290492, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "156848c8ef9d4805715e9a4fd9dd513e", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpyb290LXJvb3Q=\r\n\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpyb290LXJvb3Q=\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpyb290LXJvb3Q=", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpyb290LXJvb3Q=\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpyb290LXJvb3Q=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3f145a254449561a93bdd6033a2921da5cd0c80d", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpyb290LXJvb3Q=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpyb290LXJvb3Q=", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HDFS NAMENODE \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpyb290LXJvb3Q=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpyb290LXJvb3Q=", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "hdfs-namenode", "ssh" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 18:24:22 UTC	TCP	22 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:22 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 TA0007 TA0001 Protocole SSH SSH-2.0-libssh_0.11.4 l��?�xlQ#آ��;�mhcurve25519-sha25… Émulateur SSH WAF — Recommandation Investiguer Tags net_ssh_probe ssh_banner ssh_emulated ssh_kex_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22 Chemin / cible — Service SSH Bannière SSH SSH-2.0-libssh_0.11.4 l��?�xlQ#آ��;�mhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-s… Payload SSH-2.0-libssh_0.11.4 l��?�xlQ#آ��;�mhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux Client SSH libssh/paramiko (scanner) pat-0391 pat-0392 Upstream Technique MITRE T1046 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) SSH-2.0 banner RFC4253 libssh banner TFTP RRQ User-Agent — Règles WAF — Payload (extrait) SSH-2.0-libssh_0.11.4 l��?�xlQ#آ��;�mhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis Requête brute (extrait) SSH-2.0-libssh_0.11.4 l��?�xlQ#آ��;�mhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie Meta JSON brut { "protocol_emulated": true, "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a", "emulator_response_len": 41, "bytes_in": 1159, "payload_entropy": 4.833704082770404, "port_category": "well_known", "org": "VPS Dedicated LLC", "service": "ssh", "app_proto": "ssh", "asn": 197769, "country": "SI", "dst_port": 22, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 36, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.3, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c", "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 195, "precision_signals": [ "INT-ssh-libssh-ua", "pat-0391", "pat-0392", "INT-upstream" ], "kb_rule_ids": [ "INT-ssh-libssh-ua", "pat-0391", "pat-0392", "INT-upstream" ], "matched_patterns": [ "pat-0391", "pat-0392", "pat-0536" ], "matched_pattern_names": [ "SSH-2.0 banner RFC4253", "libssh banner", "TFTP RRQ" ], "pattern_ids": [ "pat-0391", "pat-0392", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 25, "risk_score": 50, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "ssh", "risk_confidence_factor": 100, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ca4ffa1928be7b8b604808cb808f0c07", "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca" }, "target_context": { "dst_port": 22, "service": "ssh", "service_name": "ssh", "risk_score": 50 }, "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffd?\ufffd\u0018xlQ#\u0622\ufffd\ufffd;\ufffdm\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffd?\ufffd\u0018xlQ#\u0622\ufffd\ufffd;\ufffdm\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie", "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffd?\ufffd\u0018xlQ#\u0622\ufffd\ufffd;\ufffdm\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "evidence": { "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffd?\ufffd\u0018xlQ#\u0622\ufffd\ufffd;\ufffdm\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie", "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffd?\ufffd\u0018xlQ#\u0622\ufffd\ufffd;\ufffdm\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre_techniques": [ "T1046", "T1595" ], "mitre": "T1046", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d6d09cdd2773dab2353eccbbdaf7e745d0f638bb", "protocol_details": { "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffd?\ufffd\u0018xlQ#\u0622\ufffd\ufffd;\ufffdm\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffd?\ufffd\u0018xlQ#\u0622\ufffd\ufffd;\ufffdm\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd\ufffd?\ufffdxlQ#\u0622\ufffd\ufffd;\ufffdmhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 25, "risk_score": 50, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 50, "risk_label": "Moyen", "service_name": "ssh", "service_label_fr": "SSH", "dst_port": 22, "protocol_emulated": true, "tags_summary": [ "INT-ssh-libssh-ua", "pat-0391", "pat-0392", "INT-upstream" ], "tags_summary_labels_fr": [ "Client SSH libssh\/paramiko (scanner)", "pat-0391", "pat-0392", "Upstream" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1046", "mitre_technique": "T1046", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "OpenSSH_8.9p1 Ubuntu", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffd?\ufffd\u0018xlQ#\u0622\ufffd\ufffd;\ufffdm\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffd?\ufffd\u0018xlQ#\u0622\ufffd\ufffd;\ufffdm\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "port": 22, "service": "ssh", "service_label_fr": "SSH" }, "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)", "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd\ufffd?\ufffdxlQ#\u0622\ufffd\ufffd;\ufffdmhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis", "target_port_label": "22 \u00b7 SSH", "emulator_service": "ssh", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ssh", "service_banner": "OpenSSH_8.9p1 Ubuntu", "service_os": "linux", "dst_port": "22" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "hdfs-namenode", "ssh" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "net_ssh_probe", "ssh_banner", "ssh_emulated", "ssh_kex_probe", "ssh_libssh" ], "asn_dc_heuristic": true }
15/07/2026 18:23:20 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic cm9vdDp6YXF3c3hjZGVyZnZiZ3Q= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic cm9vdDp6YXF3c3hjZGVyZnZiZ3Q= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 118, "payload_entropy": 5.2525546156880445, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 197769, "country": "SI", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cb4ec1ee0b9341c2588b6e004f4370e5", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDp6YXF3c3hjZGVyZnZiZ3Q=\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDp6YXF3c3hjZGVyZnZiZ3Q=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDp6YXF3c3hjZGVyZnZiZ3Q=", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDp6YXF3c3hjZGVyZnZiZ3Q=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDp6YXF3c3hjZGVyZnZiZ3Q=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "23909c5cf89e3c90200a75f8557ea7f221e9cb34", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDp6YXF3c3hjZGVyZnZiZ3Q=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDp6YXF3c3hjZGVyZnZiZ3Q=", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDp6YXF3c3hjZGVyZnZiZ3Q=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDp6YXF3c3hjZGVyZnZiZ3Q=", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 10:45:48 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 114, "payload_entropy": 5.131387738645402, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b6a616a27d67dc1adb685fed9a797aa7", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "55b8faec3aa4e2d24d2b39c0b9472bee0fb6f90d", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic QWRtaW5HUE9OOkFMQyNGR1U=", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 72 }
15/07/2026 10:39:43 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic dXNlcjp1c2Vy Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic dXNlcjp1c2Vy Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 102, "payload_entropy": 4.919229142153083, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5ef21a75d77dddb014a838aaa8602e3b", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8e39ea736b8ec9d23fffb52f488937209686cb0c", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjp1c2Vy", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 10:33:49 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic MTIzOjEyMw== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic MTIzOjEyMw== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 102, "payload_entropy": 4.947073310629268, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b834b8bcd2527e9d91106b8e5ecfe619", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzOjEyMw==", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzOjEyMw==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f1e6ffd89ba4ce9637d7320873ffe85d9c45742d", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzOjEyMw==", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzOjEyMw==", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzOjEyMw==", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzOjEyMw==", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 2, "behavior_priority": 84 }
15/07/2026 10:28:15 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic ODg4Ojg4OA== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic ODg4Ojg4OA== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 102, "payload_entropy": 4.9396724527649205, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "fa1fba38d0625e804aae6808cf6e7444", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5e14b6a6e2f72e624f01be7a9061607f456e6b60", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 2, "behavior_priority": 84 }
15/07/2026 10:22:58 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic cm9vdDolQkdUJTZ5aG4= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic cm9vdDolQkdUJTZ5aG4= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 110, "payload_entropy": 5.1963557574018635, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8280229d0edf38692649f1c0efaa1f7b", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDolQkdUJTZ5aG4=\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDolQkdUJTZ5aG4=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDolQkdUJTZ5aG4=", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDolQkdUJTZ5aG4=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDolQkdUJTZ5aG4=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e230c5f14e009cdac10927e53dde14a21b17ea1f", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDolQkdUJTZ5aG4=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDolQkdUJTZ5aG4=", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDolQkdUJTZ5aG4=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDolQkdUJTZ5aG4=", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 10:17:50 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 130, "payload_entropy": 5.191459373504701, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b76656c4ebbf857191ed731a8ee0120f", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "623755e31a7e1293250c5ed1bb1628ef5a22b89d", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 10:12:25 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic dXNlcjE6cGFzczE= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic dXNlcjE6cGFzczE= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 108, "payload_entropy": 5.018816370670557, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "399c716e0d091063cb4cd02c771c8d49", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "05d075c3b866d74983582dd0ebb2bdf54994ecf1", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 72 }
15/07/2026 10:07:11 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic cm9vdDpRd2FzM0RjeFoyMQ== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic cm9vdDpRd2FzM0RjeFoyMQ== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 114, "payload_entropy": 5.181060266852977, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1157121fd3e4a2d0c967688306cf1068", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpRd2FzM0RjeFoyMQ==\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpRd2FzM0RjeFoyMQ==\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpRd2FzM0RjeFoyMQ==", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpRd2FzM0RjeFoyMQ==\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpRd2FzM0RjeFoyMQ==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a494dc2f26cf588df7c129135b167e9a37d7c97e", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpRd2FzM0RjeFoyMQ==", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpRd2FzM0RjeFoyMQ==", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpRd2FzM0RjeFoyMQ==", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpRd2FzM0RjeFoyMQ==", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 72 }
15/07/2026 10:01:47 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic dmFncmFudDpxd2VydHkxMjM= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic dmFncmFudDpxd2VydHkxMjM= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 116, "payload_entropy": 5.130822071218019, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e60d775dc760d4513dc2180d56d1a671", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dmFncmFudDpxd2VydHkxMjM=\r\n\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dmFncmFudDpxd2VydHkxMjM=\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dmFncmFudDpxd2VydHkxMjM=", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dmFncmFudDpxd2VydHkxMjM=\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dmFncmFudDpxd2VydHkxMjM=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5c7fded8c432b9bfa07c46dc2c1587f2c1e50339", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dmFncmFudDpxd2VydHkxMjM=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dmFncmFudDpxd2VydHkxMjM=", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dmFncmFudDpxd2VydHkxMjM=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dmFncmFudDpxd2VydHkxMjM=", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 72 }
15/07/2026 09:56:31 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic cm9vdDptYXN1a2FqYQ== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic cm9vdDptYXN1a2FqYQ== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 110, "payload_entropy": 5.107985850985435, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8ad3a3bf94817d04542e0ed6f87c2278", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDptYXN1a2FqYQ==\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDptYXN1a2FqYQ==\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDptYXN1a2FqYQ==", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDptYXN1a2FqYQ==\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDptYXN1a2FqYQ==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1bb3d63b1af8386b34640bd1261fa2ae3cc98d26", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDptYXN1a2FqYQ==", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDptYXN1a2FqYQ==", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDptYXN1a2FqYQ==", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDptYXN1a2FqYQ==", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 72 }
15/07/2026 09:51:10 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 130.12.182.110:80 HTTP/1.0 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 36, "payload_entropy": 3.8847954873731334, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 0 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 0, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7e61442349aaac06ced7a04833c4183f", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "67cbc15e2b6eb97f67f37d8a1d088c96302f6699", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 0, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 72 }
15/07/2026 09:45:56 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 108, "payload_entropy": 4.957797014505901, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f197546faa9a59a07990e19106a2c183", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "536ffd0f007befcf25625dbb3d335e39c37519eb", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 72 }
15/07/2026 06:47:01 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic ODAwMDo4MDAw Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic ODAwMDo4MDAw Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 104, "payload_entropy": 4.90860861070352, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c6f6c84bfc023788151d9af424aec940", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw\r\n\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "016ffae276572b148bd6f757a8269088311bc52d", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic ODAwMDo4MDAw", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 06:42:52 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic MTIzNDU6MTIzNDU= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic MTIzNDU6MTIzNDU= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 106, "payload_entropy": 4.969897481228219, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "fcd6a3ef6e0cb398436320b43b04bc0d", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ca7ca0eb62ce23c9d71d3c5b498ad89b2937427f", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 06:38:50 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic cm9vdDo1MjA1MjA= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic cm9vdDo1MjA1MjA= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 106, "payload_entropy": 4.981153556388714, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "aa262e9f948a982cc049033d4b45f44f", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo1MjA1MjA=\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo1MjA1MjA=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo1MjA1MjA=", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo1MjA1MjA=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo1MjA1MjA=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a720eb94c1fb48b01cca9f77e963b791b32b5c34", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo1MjA1MjA=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo1MjA1MjA=", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo1MjA1MjA=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDo1MjA1MjA=", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 06:35:01 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 130.12.182.110:80 HTTP/1.0 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 36, "payload_entropy": 3.8847954873731334, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "https", "app_proto": "https", "asn": 197769, "country": "SI", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 0 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 0, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7e61442349aaac06ced7a04833c4183f", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\n", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "evidence": { "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "67cbc15e2b6eb97f67f37d8a1d088c96302f6699", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 0, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 06:29:20 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.110:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 130.12.182.110:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 130.12.182.110:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 130.12.182.110:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 130.12.182.110:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "110:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 36, "payload_entropy": 3.8847954873731334, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "9b37aa77fbf72b4850b1294ad30b3e924bbc5452", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7e61442349aaac06ced7a04833c4183f", "path_pattern_hash": "0597d3f76c01271498156690f9e0137d" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9d5517606e0a9530879fabe2bc03386d15055e3c", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 06:25:20 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.110:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 130.12.182.110:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 130.12.182.110:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 130.12.182.110:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 130.12.182.110:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic cm9vdDpQYXNzdzByZF8xLjA= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "110:80", "http_ua_hash": null, "http_host_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_target_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 114, "payload_entropy": 5.220081152955667, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "9b37aa77fbf72b4850b1294ad30b3e924bbc5452", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8b0b72fed318609c666f664940eb3d40", "path_pattern_hash": "0597d3f76c01271498156690f9e0137d" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZF8xLjA=\r\n", "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZF8xLjA=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZF8xLjA=", "evidence": { "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZF8xLjA=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZF8xLjA=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "653cea691273286c715a773ebabcbd81e8bf35a1", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZF8xLjA=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzdzByZF8xLjA=", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 06:21:52 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.110:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 130.12.182.110:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 130.12.182.110:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 130.12.182.110:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 130.12.182.110:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic d2ViOjEyMzQ= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "110:80", "http_ua_hash": null, "http_host_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_target_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 102, "payload_entropy": 4.950900364801456, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "9b37aa77fbf72b4850b1294ad30b3e924bbc5452", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7da1b08343903253d69c6b1b8faa0937", "path_pattern_hash": "0597d3f76c01271498156690f9e0137d" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic d2ViOjEyMzQ=\r\n", "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic d2ViOjEyMzQ=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic d2ViOjEyMzQ=", "evidence": { "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic d2ViOjEyMzQ=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic d2ViOjEyMzQ=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0b0d5de83c3a1fe72a5d3dbb4a3fdb091fe56a8d", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic d2ViOjEyMzQ=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic d2ViOjEyMzQ=", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 06:18:09 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.110:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 130.12.182.110:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 130.12.182.110:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 130.12.182.110:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 130.12.182.110:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "110:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 36, "payload_entropy": 3.8847954873731334, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "9b37aa77fbf72b4850b1294ad30b3e924bbc5452", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7e61442349aaac06ced7a04833c4183f", "path_pattern_hash": "0597d3f76c01271498156690f9e0137d" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9d5517606e0a9530879fabe2bc03386d15055e3c", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 06:14:24 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.110:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 130.12.182.110:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 130.12.182.110:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 130.12.182.110:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 130.12.182.110:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic bW1kOm1tZA== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "110:80", "http_ua_hash": null, "http_host_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_target_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 4.906900288108359, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "9b37aa77fbf72b4850b1294ad30b3e924bbc5452", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "88470652522e56c91f3fae47ecbc0ebd", "path_pattern_hash": "0597d3f76c01271498156690f9e0137d" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bW1kOm1tZA==\r\n\r\n", "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bW1kOm1tZA==\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bW1kOm1tZA==", "evidence": { "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bW1kOm1tZA==\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bW1kOm1tZA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d0097e99c16896f6ec4187a487c09e9b7f560808", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bW1kOm1tZA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bW1kOm1tZA==", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 06:10:36 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.110:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 130.12.182.110:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 130.12.182.110:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 130.12.182.110:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 130.12.182.110:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "110:80", "http_ua_hash": null, "http_host_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_target_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 132, "payload_entropy": 5.278828348345374, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "9b37aa77fbf72b4850b1294ad30b3e924bbc5452", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a2dfd31089810af95749d9495fe79094", "path_pattern_hash": "0597d3f76c01271498156690f9e0137d" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "evidence": { "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d39b536d21b237b898858bde9d3f0db98b7a4657", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 06:07:32 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.110:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 130.12.182.110:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 130.12.182.110:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 130.12.182.110:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 130.12.182.110:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "110:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 36, "payload_entropy": 3.8847954873731334, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "9b37aa77fbf72b4850b1294ad30b3e924bbc5452", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7e61442349aaac06ced7a04833c4183f", "path_pattern_hash": "0597d3f76c01271498156690f9e0137d" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9d5517606e0a9530879fabe2bc03386d15055e3c", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 06:03:56 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.110:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 130.12.182.110:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 130.12.182.110:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 130.12.182.110:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 130.12.182.110:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic dXNlcjM6IXFhejJ3c3g= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "110:80", "http_ua_hash": null, "http_host_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_target_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 110, "payload_entropy": 5.142718170766498, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "9b37aa77fbf72b4850b1294ad30b3e924bbc5452", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cb15ef177f94ee9038d080facd8b0d3c", "path_pattern_hash": "0597d3f76c01271498156690f9e0137d" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjM6IXFhejJ3c3g=\r\n", "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjM6IXFhejJ3c3g=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjM6IXFhejJ3c3g=", "evidence": { "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjM6IXFhejJ3c3g=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjM6IXFhejJ3c3g=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a9b3b66b78b6dc6807499aff44b2943ada224fd3", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjM6IXFhejJ3c3g=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjM6IXFhejJ3c3g=", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 06:00:32 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.110:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 130.12.182.110:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 130.12.182.110:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 130.12.182.110:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 130.12.182.110:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic bGluZGE6MTIzNA== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "110:80", "http_ua_hash": null, "http_host_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_target_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.039785467952875, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "9b37aa77fbf72b4850b1294ad30b3e924bbc5452", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "53efed05f47b0df18737f7f8f526ec8b", "path_pattern_hash": "0597d3f76c01271498156690f9e0137d" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bGluZGE6MTIzNA==\r\n\r\n", "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bGluZGE6MTIzNA==\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bGluZGE6MTIzNA==", "evidence": { "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bGluZGE6MTIzNA==\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bGluZGE6MTIzNA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dac9484f8ae3646e6e13b2b410620ea37dc60196", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bGluZGE6MTIzNA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic bGluZGE6MTIzNA==", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 05:56:50 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.110:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 130.12.182.110:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 130.12.182.110:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 130.12.182.110:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 130.12.182.110:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "110:80", "http_ua_hash": null, "http_host_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_target_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 61, "payload_entropy": 3.96973112083654, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "9b37aa77fbf72b4850b1294ad30b3e924bbc5452", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ac7cf1c13afba5eb9717b7802eac9aab", "path_pattern_hash": "0597d3f76c01271498156690f9e0137d" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\n", "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80", "evidence": { "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8bf0e829b2219b994cf807b0d3b6d8427c366334", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 05:53:27 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.110:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 130.12.182.110:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 130.12.182.110:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 130.12.182.110:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 130.12.182.110:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic dGVzdDoxMjM0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "110:80", "http_ua_hash": null, "http_host_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_target_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 102, "payload_entropy": 4.94008268786263, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "9b37aa77fbf72b4850b1294ad30b3e924bbc5452", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8d790bbd29787c193a6421474db9d28e", "path_pattern_hash": "0597d3f76c01271498156690f9e0137d" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0\r\n", "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0", "evidence": { "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "170f3c9d339b356bbe2140d5b1153a2b92ac8b19", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dGVzdDoxMjM0", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 05:50:02 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.110:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 130.12.182.110:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 130.12.182.110:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 130.12.182.110:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 130.12.182.110:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic dGVzdDp0ZXN0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "110:80", "http_ua_hash": null, "http_host_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_target_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 102, "payload_entropy": 4.943273158051773, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "9b37aa77fbf72b4850b1294ad30b3e924bbc5452", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "948dc9dc8d9073153af11c1cf4ad0deb", "path_pattern_hash": "0597d3f76c01271498156690f9e0137d" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n", "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "evidence": { "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1159d162ce40c658a04b860cec0e4e997ce1590d", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 05:48:30 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.110:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 130.12.182.110:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 130.12.182.110:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 130.12.182.110:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 130.12.182.110:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic c2s6c2s= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "110:80", "http_ua_hash": null, "http_host_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_target_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 100, "payload_entropy": 4.788899367762383, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "9b37aa77fbf72b4850b1294ad30b3e924bbc5452", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4a8809a0b4018022f763017293cd95c2", "path_pattern_hash": "0597d3f76c01271498156690f9e0137d" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic c2s6c2s=\r\n\r\n", "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic c2s6c2s=\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic c2s6c2s=", "evidence": { "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic c2s6c2s=\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic c2s6c2s=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d42048f00d1fef5cfd5831b1f55b85789a407bb0", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic c2s6c2s=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic c2s6c2s=", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 05:44:35 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.110:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 130.12.182.110:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 130.12.182.110:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 130.12.182.110:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 130.12.182.110:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic dXNlcjpwYXNz Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "110:80", "http_ua_hash": null, "http_host_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_target_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 4.977064528768556, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "9b37aa77fbf72b4850b1294ad30b3e924bbc5452", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "be92d9d40cf7ac6789f8f58c873d99de", "path_pattern_hash": "0597d3f76c01271498156690f9e0137d" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjpwYXNz\r\n\r\n", "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjpwYXNz\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjpwYXNz", "evidence": { "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjpwYXNz\r\n\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjpwYXNz", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2140e354b93f8e1a404a357455a05f2e799f2311", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjpwYXNz", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic dXNlcjpwYXNz", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
15/07/2026 05:41:12 UTC	TCP	8889 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 130.12.182.110:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 130.12.182.110:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 130.12.182.110:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8889 Chemin / cible 130.12.182.110:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 130.12.182.110:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 130.12.182.110:80 HTTP/1.0 Host: 130.12.182.110:80 Proxy-Authorization: Basic cm9vdDpQYXNzd29ydCEyMzQ= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "110:80", "http_ua_hash": null, "http_host_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_target_hash": "7e7a6631ad307b3168698fa303c5f64b13ea131e", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 114, "payload_entropy": 5.14758411342505, "port_category": "registered", "org": "VPS Dedicated LLC", "service": "http", "app_proto": "http", "asn": 197769, "country": "SI", "dst_port": 8889, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.1, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5", "event_fingerprint": "9b37aa77fbf72b4850b1294ad30b3e924bbc5452", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "SI", "asn": 197769, "org": "VPS Dedicated LLC", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b8754a963d0f463d4db0d7fedaa45e3b", "path_pattern_hash": "0597d3f76c01271498156690f9e0137d" }, "service_name": "http", "target_context": { "dst_port": 8889, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzd29ydCEyMzQ=\r\n", "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzd29ydCEyMzQ=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzd29ydCEyMzQ=", "evidence": { "method": "CONNECT", "path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "request_sample": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzd29ydCEyMzQ=\r\n", "payload_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzd29ydCEyMzQ=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5b5b703c0618c8b281655dce24b0db2393ef7105", "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzd29ydCEyMzQ=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8889, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "130.12.182.110:80", "request_line": "CONNECT 130.12.182.110:80 HTTP\/1.1", "port": 8889, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.110:80", "evidence_snippet": "CONNECT 130.12.182.110:80 HTTP\/1.0\r\nHost: 130.12.182.110:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzd29ydCEyMzQ=", "target_port_label": "8889 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8889" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }

130.12.182.110

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence