Détails IP 138.226.239.90

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « postgres_probe » (signaux protocolaires) · confiance 49%

Confiance 49 % — Score WAF 8

Comparaison ASN / FAI

ASN 213474 · 138.226.239.0/24 · RIPENCC — 3 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 8 événements sur la période pour cette IP.

138.226.239.7 Sonde RDP 28/07/2026 15:19 UTC
138.226.239.91 Sonde PostgreSQL 21/07/2026 15:52 UTC
85.239.147.8 Sonde TLS 10/04/2026 12:03 UTC

IPs apparentées

Même FAI HomeLine Broadband LLC — corrélation indicative.

138.226.239.7 Sonde RDP
138.226.239.91 Sonde PostgreSQL
85.239.147.8 Sonde TLS

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

TLS TCP 6 HTTPS TCP 1 HTTPS ALT 20443 TCP 1

TLS

6

HTTPS

1

HTTPS ALT 20443

1

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

8 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
21/07/2026 15:38:45 UTC	TCP	21443 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:21443 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 6639916abfac56b9 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 21443 Chemin / cible — Service TLS Payload ��o�&d��xǒ�2=�-�L�s�� 2�jY�� u��N��0\�f�N��HT>&�f� ��"��+�/�,�0̨̩� �� A � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��o�&d��xǒ�2=�-�L�s�� 2�jY�� u��N��0\�f�N��HT>&�f� ��"��+�/�,�0̨̩� �� A� Requête brute (extrait) ��o�&d��xǒ�2=�-�L�s�� 2�jY�� u��N��0\�f�N��HT>&�f� ��"��+�/�,�0̨̩� �� A � � +3��M��L��c<U'ą�� c��e��8��Q�+M��G�� x�SG O�� Meta JSON brut { "tls_ja3_hash": "6639916abfac56b9257ca216677085bc", "tls_sni": null, "bytes_in": 1453, "payload_entropy": 7.74806250516472, "port_category": "registered", "org": "HomeLine Broadband LLC", "service": "tls", "app_proto": "tls", "asn": 213474, "country": "GB", "dst_port": 21443, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "fd409cf32a857b88d0f73074adc3d9a66055e440", "event_fingerprint": "8a547e7f075b93d91690f2952d43e4f7c3bdc942", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 213474, "org": "HomeLine Broadband LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "6639916abfac56b9257ca216677085bc", "payload_hash": "9c2bc61ed3cd7862f9e3002cd5c1198d", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 21443, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003o\ufffd&d\u0019\ufffd\ufffd\u001a\ufffdx\u01d2\ufffd2=\ufffd-\ufffdL\ufffds\u0017\ufffd\ufffd\ufffd\r2\ufffdjY\ufffd\ufffd u\ufffd\ufffd\u001a\ufffd\ufffdN\ufffd\ufffd0\\\u0010\u0007\ufffdf\u0018\ufffdN\ufffd\ufffdHT>&\ufffdf\ufffd\r\ufffd\ufffd\"\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003o\ufffd&d\u0019\ufffd\ufffd\u001a\ufffdx\u01d2\ufffd2=\ufffd-\ufffdL\ufffds\u0017\ufffd\ufffd\ufffd\r2\ufffdjY\ufffd\ufffd u\ufffd\ufffd\u001a\ufffd\ufffdN\ufffd\ufffd0\\\u0010\u0007\ufffdf\u0018\ufffdN\ufffd\ufffdHT>&\ufffdf\ufffd\r\ufffd\ufffd\"\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\u0005\ufffdM\ufffd\u001b\ufffd\ufffdL\ufffd\ufffdc<U'\u0105\ufffd\ufffd\ufffd\ufffd\nc\ufffd\ufffde\ufffd\ufffd8\ufffd\ufffdQ\ufffd+M\ufffd\ufffdG\u000e\ufffd\u0001\ufffd\n\ufffdx\ufffdSG\u000bO\ufffd\ufffd\u001f\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003o\ufffd&d\u0019\ufffd\ufffd\u001a\ufffdx\u01d2\ufffd2=\ufffd-\ufffdL\ufffds\u0017\ufffd\ufffd\ufffd\r2\ufffdjY\ufffd\ufffd u\ufffd\ufffd\u001a\ufffd\ufffdN\ufffd\ufffd0\\\u0010\u0007\ufffdf\u0018\ufffdN\ufffd\ufffdHT>&\ufffdf\ufffd\r\ufffd\ufffd\"\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7368b429fa567ac9dc6c0824dbb34ee32d958744", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003o\ufffd&d\u0019\ufffd\ufffd\u001a\ufffdx\u01d2\ufffd2=\ufffd-\ufffdL\ufffds\u0017\ufffd\ufffd\ufffd\r2\ufffdjY\ufffd\ufffd u\ufffd\ufffd\u001a\ufffd\ufffdN\ufffd\ufffd0\\\u0010\u0007\ufffdf\u0018\ufffdN\ufffd\ufffdHT>&\ufffdf\ufffd\r\ufffd\ufffd\"\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "6639916abfac56b9257ca216677085bc", "port": 21443, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdo\ufffd&d\ufffd\ufffd\ufffdx\u01d2\ufffd2=\ufffd-\ufffdL\ufffds\ufffd\ufffd\ufffd\r2\ufffdjY\ufffd\ufffd u\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffd0\\\ufffdf\ufffdN\ufffd\ufffdHT>&\ufffdf\ufffd\r\ufffd\ufffd\"\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdA\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:21443 \u00b7 (sonde \/ probe)", "target_port_label": "21443 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 21443, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003o\ufffd&d\u0019\ufffd\ufffd\u001a\ufffdx\u01d2\ufffd2=\ufffd-\ufffdL\ufffds\u0017\ufffd\ufffd\ufffd\r2\ufffdjY\ufffd\ufffd u\ufffd\ufffd\u001a\ufffd\ufffdN\ufffd\ufffd0\\\u0010\u0007\ufffdf\u0018\ufffdN\ufffd\ufffdHT>&\ufffdf\ufffd\r\ufffd\ufffd\"\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "6639916abfac56b9257ca216677085bc", "port": 21443, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:21443 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdo\ufffd&d\ufffd\ufffd\ufffdx\u01d2\ufffd2=\ufffd-\ufffdL\ufffds\ufffd\ufffd\ufffd\r2\ufffdjY\ufffd\ufffd u\ufffd\ufffd\ufffd\ufffdN\ufffd\ufffd0\\\ufffdf\ufffdN\ufffd\ufffdHT>&\ufffdf\ufffd\r\ufffd\ufffd\"\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdA\ufffd", "target_port_label": "21443 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "21443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
21/07/2026 15:29:55 UTC	TCP	13443 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:13443 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 6639916abfac56b9 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 13443 Chemin / cible — Service TLS Payload ��ո��L�6R��uv�3.�<�x��~�i K��OU�ah�p�}93� Vp��]"��^�+�/�,�0̨̩� �� A � Pourquoi cette classification :* Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��ո��L�6R��uv�3.�<�x��~�i K��OU�ah�p�}93�Vp��]"��^�+�/�,�0̨̩� �� A� Requête brute (extrait) ��ո��L�6R��uv�3.�<�x��~�i K��OU�ah�p�}93� Vp��]"��^�+�/�,�0̨̩� �� A � � +3�� q#��]�@�Ys��3�`eQB��t0��o_�b��#(9�&GZ5��u)ǧR� Meta JSON brut { "tls_ja3_hash": "6639916abfac56b9257ca216677085bc", "tls_sni": null, "bytes_in": 1453, "payload_entropy": 7.7780321123158345, "port_category": "registered", "org": "HomeLine Broadband LLC", "service": "tls", "app_proto": "tls", "asn": 213474, "country": "GB", "dst_port": 13443, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "dbc5726a6326041d6a46c37348b630f55a7e25c6", "event_fingerprint": "cf00ce00175ec85798a631d7423383d09b9b9119", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 213474, "org": "HomeLine Broadband LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "6639916abfac56b9257ca216677085bc", "payload_hash": "6d626d24f9b6857686f05f82d2b36c00", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 13443, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0000\ufffd\u0578\ufffd\ufffd\ufffd\ufffdL\ufffd6R\ufffd\u0005\ufffduv\ufffd3.\ufffd\u0007<\ufffdx\ufffd\ufffd~\ufffdi K\ufffd\ufffdOU\ufffdah\ufffdp\ufffd}9\u001d\u00163\ufffd\fV\u001ap\ufffd\ufffd\ufffd]\"\ufffd\ufffd\ufffd\ufffd\ufffd^\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0000\ufffd\u0578\ufffd\ufffd\ufffd\ufffdL\ufffd6R\ufffd\u0005\ufffduv\ufffd3.\ufffd\u0007<\ufffdx\ufffd\ufffd~\ufffdi K\ufffd\ufffdOU\ufffdah\ufffdp\ufffd}9\u001d\u00163\ufffd\fV\u001ap\ufffd\ufffd\ufffd]\"\ufffd\ufffd\ufffd\ufffd\ufffd^\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\fq#\ufffd\ufffd]\ufffd@\ufffdY\u0011s\ufffd\ufffd\u001c\ufffd\ufffd3\ufffd`eQB\ufffd\ufffdt0\ufffd\ufffdo_\ufffdb\ufffd\ufffd\u001c#(9\u0017\ufffd&GZ5\ufffd\ufffd\ufffdu)\u01e7R\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0000\ufffd\u0578\ufffd\ufffd\ufffd\ufffdL\ufffd6R\ufffd\u0005\ufffduv\ufffd3.\ufffd\u0007<\ufffdx\ufffd\ufffd~\ufffdi K\ufffd\ufffdOU\ufffdah\ufffdp\ufffd}9\u001d\u00163\ufffd\fV\u001ap\ufffd\ufffd\ufffd]\"\ufffd\ufffd\ufffd\ufffd\ufffd^\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b3616e8ec6274569b5a0416fac1198c5c9b385b0", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0000\ufffd\u0578\ufffd\ufffd\ufffd\ufffdL\ufffd6R\ufffd\u0005\ufffduv\ufffd3.\ufffd\u0007<\ufffdx\ufffd\ufffd~\ufffdi K\ufffd\ufffdOU\ufffdah\ufffdp\ufffd}9\u001d\u00163\ufffd\fV\u001ap\ufffd\ufffd\ufffd]\"\ufffd\ufffd\ufffd\ufffd\ufffd^\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "6639916abfac56b9257ca216677085bc", "port": 13443, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\u0578\ufffd\ufffd\ufffd\ufffdL\ufffd6R\ufffd\ufffduv\ufffd3.\ufffd<\ufffdx\ufffd\ufffd~\ufffdi K\ufffd\ufffdOU\ufffdah\ufffdp\ufffd}93\ufffdVp\ufffd\ufffd\ufffd]\"\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdA\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:13443 \u00b7 (sonde \/ probe)", "target_port_label": "13443 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 13443, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0000\ufffd\u0578\ufffd\ufffd\ufffd\ufffdL\ufffd6R\ufffd\u0005\ufffduv\ufffd3.\ufffd\u0007<\ufffdx\ufffd\ufffd~\ufffdi K\ufffd\ufffdOU\ufffdah\ufffdp\ufffd}9\u001d\u00163\ufffd\fV\u001ap\ufffd\ufffd\ufffd]\"\ufffd\ufffd\ufffd\ufffd\ufffd^\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "6639916abfac56b9257ca216677085bc", "port": 13443, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:13443 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\u0578\ufffd\ufffd\ufffd\ufffdL\ufffd6*R\ufffd\ufffduv\ufffd3.\ufffd<\ufffdx\ufffd\ufffd~\ufffdi K\ufffd\ufffdOU\ufffdah\ufffdp\ufffd}93\ufffdVp\ufffd\ufffd\ufffd]\"\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdA\ufffd", "target_port_label": "13443 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "13443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
21/07/2026 15:00:38 UTC	TCP	16443 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:16443 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 6639916abfac56b9 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 16443 Chemin / cible — Service TLS Payload ��Y �f��u 5T�46G�aL�j��p ��h�{�'�w�L�\�ԗi��<I��@��p�+�/�,�0̨̩� �� A � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Y�f��u 5T�46G�aL�j��p ��h�{�'�w�L�\�ԗi��<I��@��p�+�/�,�0̨̩� �� A� Requête brute (extrait) ��Y �f��u 5T�46G�aL�j��p ��h�{�'�w�L�\�ԗi��<I��@��p�+�/�,�0̨̩� �� A � � +3��w��̝�� kTy�.'x�`��X�� i�+u��{92(��G? Meta JSON brut { "tls_ja3_hash": "6639916abfac56b9257ca216677085bc", "tls_sni": null, "bytes_in": 1453, "payload_entropy": 7.739609813116497, "port_category": "registered", "org": "HomeLine Broadband LLC", "service": "tls", "app_proto": "tls", "asn": 213474, "country": "GB", "dst_port": 16443, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.8, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "4e102e55b9f422911ce6f49109bc0e8ccc9dac87", "event_fingerprint": "271304f916eaf58b7b5964ade7e9c7dcaf3e034e", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 213474, "org": "HomeLine Broadband LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "6639916abfac56b9257ca216677085bc", "payload_hash": "c6070b9a3870c1f5414d0ba9c41fccf2", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 16443, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdY\u000b\ufffdf\ufffd\u0005\ufffd\ufffd\ufffdu\u0002\n5\u0004T\ufffd46\u001cG\ufffdaL\ufffdj\ufffd\ufffdp \ufffd\ufffdh\ufffd{\ufffd'\u0013\ufffdw\ufffdL\ufffd\\\ufffd\u0517i\ufffd\ufffd<I\ufffd\ufffd@\ufffd\ufffdp\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdY\u000b\ufffdf\ufffd\u0005\ufffd\ufffd\ufffdu\u0002\n5\u0004T\ufffd46\u001cG\ufffdaL\ufffdj\ufffd\ufffdp \ufffd\ufffdh\ufffd{\ufffd'\u0013\ufffdw\ufffdL\ufffd\\\ufffd\u0517i\ufffd\ufffd<I\ufffd\ufffd@\ufffd\ufffdp\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdw\ufffd\u0015\ufffd\u031d\ufffd\ufffd\u000e\ufffd\u000bkTy\ufffd.'x\u0002\ufffd`\ufffd\ufffd\u000e\u001b\ufffdX\ufffd\u0007\ufffd\u0001\ufffd\ufffd\ufffd\ufffd\f\ufffd\ufffdi\ufffd+u\ufffd\ufffd\ufffd{92(\b\ufffd\ufffdG?", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdY\u000b\ufffdf\ufffd\u0005\ufffd\ufffd\ufffdu\u0002\n5\u0004T\ufffd46\u001cG\ufffdaL\ufffdj\ufffd\ufffdp \ufffd\ufffdh\ufffd{\ufffd'\u0013\ufffdw\ufffdL\ufffd\\\ufffd\u0517i\ufffd\ufffd<I\ufffd\ufffd@\ufffd\ufffdp\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fcb5b84c4c42c93399328c67815dc868005460c6", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdY\u000b\ufffdf\ufffd\u0005\ufffd\ufffd\ufffdu\u0002\n5\u0004T\ufffd46\u001cG\ufffdaL\ufffdj\ufffd\ufffdp \ufffd\ufffdh\ufffd{\ufffd'\u0013\ufffdw\ufffdL\ufffd\\\ufffd\u0517i\ufffd\ufffd<I\ufffd\ufffd@\ufffd\ufffdp\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "6639916abfac56b9257ca216677085bc", "port": 16443, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffdf\ufffd\ufffd\ufffd\ufffdu\n5T\ufffd46G\ufffdaL\ufffdj\ufffd\ufffdp \ufffd\ufffdh\ufffd{\ufffd'\ufffdw\ufffdL\ufffd\\\ufffd\u0517i\ufffd\ufffd<I\ufffd\ufffd@\ufffd\ufffdp\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdA\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:16443 \u00b7 (sonde \/ probe)", "target_port_label": "16443 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 16443, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffdY\u000b\ufffdf\ufffd\u0005\ufffd\ufffd\ufffdu\u0002\n5\u0004T\ufffd46\u001cG\ufffdaL\ufffdj\ufffd\ufffdp \ufffd\ufffdh\ufffd{\ufffd'\u0013\ufffdw\ufffdL\ufffd\\\ufffd\u0517i\ufffd\ufffd<I\ufffd\ufffd@\ufffd\ufffdp\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "6639916abfac56b9257ca216677085bc", "port": 16443, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:16443 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdY\ufffdf\ufffd\ufffd\ufffd\ufffdu\n5T\ufffd46G\ufffdaL\ufffdj\ufffd\ufffdp \ufffd\ufffdh\ufffd{\ufffd'\ufffdw\ufffdL\ufffd\\\ufffd\u0517i\ufffd\ufffd<I\ufffd\ufffd@\ufffd\ufffdp\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdA\ufffd", "target_port_label": "16443 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "16443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
21/07/2026 14:58:09 UTC	TCP	22443 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:22443 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 6639916abfac56b9 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 22443 Chemin / cible — Service TLS Payload ��Z��k��Է��qY��zy��.꒠AeH' &��F6��P^M1e�I�I��>&�e��+�/�,�0̨̩� �� A � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Z��k��Է��qY��zy��.꒠AeH' &��F6��P^M1e�I�I��>&�e��+�/�,�0̨̩� �� A� Requête brute (extrait) ��Z��k��Է��qY��zy��.꒠AeH' &��F6��P^M1e�I�I��>&�e��+�/�,�0̨̩� �� A � � +3��8��J'� i[WVx��;p�� r��Kي��:�#y�ӣ]��ץf��3� Meta JSON brut { "tls_ja3_hash": "6639916abfac56b9257ca216677085bc", "tls_sni": null, "bytes_in": 1453, "payload_entropy": 7.73459316347784, "port_category": "registered", "org": "HomeLine Broadband LLC", "service": "tls", "app_proto": "tls", "asn": 213474, "country": "GB", "dst_port": 22443, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "77255e44a94f67e00714e17e08b1c12c8414f14b", "event_fingerprint": "6e93bc35fe18daeab618664fdd1a11d8731c153e", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 213474, "org": "HomeLine Broadband LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "6639916abfac56b9257ca216677085bc", "payload_hash": "288fdc62047a9a5704ca2e5e0a44f2cb", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 22443, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\ufffd\ufffdk\ufffd\ufffd\ufffd\u0537\ufffd\ufffd\ufffd\ufffdqY\ufffd\ufffdz\u0002y\ufffd\ufffd.\u0004\ua4a0AeH' &\ufffd\ufffd\ufffd\ufffdF6\ufffd\ufffdP^\u001eM1e\ufffdI\ufffdI\ufffd\ufffd\ufffd>&\u0002\u001b\ufffde\u0018\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\ufffd\ufffdk\ufffd\ufffd\ufffd\u0537\ufffd\ufffd\ufffd\ufffdqY\ufffd\ufffdz\u0002y\ufffd\ufffd.\u0004\ua4a0AeH' &\ufffd\ufffd\ufffd\ufffdF6\ufffd\ufffdP^\u001eM1e\ufffdI\ufffdI\ufffd\ufffd\ufffd>&\u0002\u001b\ufffde\u0018\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\u001f8\ufffd\u0012\ufffdJ'\ufffd\ti[WV\u0003x\ufffd\ufffd;p\ufffd\ufffd\f\u001c\ufffdr\ufffd\ufffd\u0005K\u064a\ufffd\ufffd:\ufffd#y\ufffd\u04e3]\ufffd\ufffd\u05e5f\ufffd\ufffd\u001f\ufffd\ufffd3\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\ufffd\ufffdk\ufffd\ufffd\ufffd\u0537\ufffd\ufffd\ufffd\ufffdqY\ufffd\ufffdz\u0002y\ufffd\ufffd.\u0004\ua4a0AeH' &\ufffd\ufffd\ufffd\ufffdF6\ufffd\ufffdP^\u001eM1e\ufffdI\ufffdI\ufffd\ufffd\ufffd>&\u0002\u001b\ufffde\u0018\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "873dd6fe7a05dd01006903b3050a237c3018b08b", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\ufffd\ufffdk\ufffd\ufffd\ufffd\u0537\ufffd\ufffd\ufffd\ufffdqY\ufffd\ufffdz\u0002y\ufffd\ufffd.\u0004\ua4a0AeH' &\ufffd\ufffd\ufffd\ufffdF6\ufffd\ufffdP^\u001eM1e\ufffdI\ufffdI\ufffd\ufffd\ufffd>&\u0002\u001b\ufffde\u0018\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "6639916abfac56b9257ca216677085bc", "port": 22443, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdZ\ufffd\ufffdk\ufffd\ufffd\ufffd\u0537\ufffd\ufffd\ufffd\ufffdqY\ufffd\ufffdzy\ufffd\ufffd.\ua4a0AeH' &\ufffd\ufffd\ufffd\ufffdF6\ufffd\ufffdP^M1e\ufffdI\ufffdI\ufffd\ufffd\ufffd>&\ufffde\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdA\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:22443 \u00b7 (sonde \/ probe)", "target_port_label": "22443 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 22443, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003Z\ufffd\ufffdk\ufffd\ufffd\ufffd\u0537\ufffd\ufffd\ufffd\ufffdqY\ufffd\ufffdz\u0002y\ufffd\ufffd.\u0004\ua4a0AeH' &\ufffd\ufffd\ufffd\ufffdF6\ufffd\ufffdP^\u001eM1e\ufffdI\ufffdI\ufffd\ufffd\ufffd>&\u0002\u001b\ufffde\u0018\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "6639916abfac56b9257ca216677085bc", "port": 22443, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:22443 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdZ\ufffd\ufffdk\ufffd\ufffd\ufffd\u0537\ufffd\ufffd\ufffd\ufffdqY\ufffd\ufffdzy\ufffd\ufffd.\ua4a0AeH' &\ufffd\ufffd\ufffd\ufffdF6\ufffd\ufffdP^M1e\ufffdI\ufffdI\ufffd\ufffd\ufffd>&\ufffde\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdA\ufffd", "target_port_label": "22443 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "22443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
21/07/2026 14:29:15 UTC	TCP	10443 · HTTPS	https	Sonde PostgreSQL postgres probe · via HTTPS:10443 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10443 Chemin / cible — Service HTTPS Payload ��䉰��R��V7:�K�ƎY��qw� ��?��?�V��&�8��gA�H+�/��3�+�/�,�0̨̩� �� A � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��䉰��R��V7:�K�ƎY��qw� ��?��?�V��&�8��gA�H+�/��3�+�/�,�0̨̩� �� A� Requête brute (extrait) ��䉰��R��V7:�K�ƎY��qw� ��?��?�V��&�8��gA�H+�/��3�+�/�,�0̨̩� �� A � � +3��o��g��k��J�f',��q�� Ll{��;D#��R液�<ӌ� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 1453, "payload_entropy": 7.764323421281866, "port_category": "registered", "org": "HomeLine Broadband LLC", "service": "https", "app_proto": "https", "asn": 213474, "country": "GB", "dst_port": 10443, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "bf82ed4958219b6801f74213ab3f101ded76679b", "event_fingerprint": "0ce879e35222bcf244eb8071cb051f2e9c4aa580", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 213474, "org": "HomeLine Broadband LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e53fde994ef680180ecd30d49cdf216f", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 10443, "service": "https", "service_name": "https", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0015\u4270\ufffd\ufffd\ufffd\ufffd\u000f\ufffdR\u000e\ufffd\ufffdV7:\ufffd\u0004K\ufffd\u018e\u0007Y\ufffd\ufffd\ufffdqw\ufffd \ufffd\ufffd?\ufffd\ufffd\u0003\ufffd?\ufffdV\ufffd\u0019\ufffd\ufffd&\ufffd8\ufffd\ufffd\u0014\ufffdgA\ufffdH+\ufffd\/\ufffd\ufffd\ufffd3\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0015\u4270\ufffd\ufffd\ufffd\ufffd\u000f\ufffdR\u000e\ufffd\ufffdV7:\ufffd\u0004K\ufffd\u018e\u0007Y\ufffd\ufffd\ufffdqw\ufffd \ufffd\ufffd?\ufffd\ufffd\u0003\ufffd?\ufffdV\ufffd\u0019\ufffd\ufffd&\ufffd8\ufffd\ufffd\u0014\ufffdgA\ufffdH+\ufffd\/\ufffd\ufffd\ufffd3\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdo\ufffd\ufffd\ufffdg\ufffd\ufffdk\u0002\ufffd\u001c\ufffd\ufffd\ufffdJ\u0017\ufffdf',\ufffd\ufffd\ufffd\u0007q\ufffd\ufffd\u0007\tLl{\ufffd\ufffd\u0003\ufffd\ufffd\ufffd\ufffd;D#\u001e\ufffd\ufffdR\u6db2\ufffd<\u0003\u04cc\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0015\u4270\ufffd\ufffd\ufffd\ufffd\u000f\ufffdR\u000e\ufffd\ufffdV7:\ufffd\u0004K\ufffd\u018e\u0007Y\ufffd\ufffd\ufffdqw\ufffd \ufffd\ufffd?\ufffd\ufffd\u0003\ufffd?\ufffdV\ufffd\u0019\ufffd\ufffd&\ufffd8\ufffd\ufffd\u0014\ufffdgA\ufffdH+\ufffd\/\ufffd\ufffd\ufffd3\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2b95ef7b7a4cf73d65f0a75842f8d0c6f0a7a28b", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0015\u4270\ufffd\ufffd\ufffd\ufffd\u000f\ufffdR\u000e\ufffd\ufffdV7:\ufffd\u0004K\ufffd\u018e\u0007Y\ufffd\ufffd\ufffdqw\ufffd \ufffd\ufffd?\ufffd\ufffd\u0003\ufffd?\ufffdV\ufffd\u0019\ufffd\ufffd&\ufffd8\ufffd\ufffd\u0014\ufffdgA\ufffdH+\ufffd\/\ufffd\ufffd\ufffd3\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 10443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\u4270\ufffd\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffdV7:\ufffdK\ufffd\u018eY\ufffd\ufffd\ufffdqw\ufffd \ufffd\ufffd?\ufffd\ufffd\ufffd?\ufffdV\ufffd\ufffd\ufffd&\ufffd8\ufffd\ufffd\ufffdgA\ufffdH+\ufffd\/\ufffd\ufffd\ufffd3\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdA\ufffd", "attack_vector": "postgres probe \u00b7 via HTTPS:10443 \u00b7 (sonde \/ probe)", "target_port_label": "10443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 10443, "protocol_emulated": true, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\u0015\u4270\ufffd\ufffd\ufffd\ufffd\u000f\ufffdR\u000e\ufffd\ufffdV7:\ufffd\u0004K\ufffd\u018e\u0007Y\ufffd\ufffd\ufffdqw\ufffd \ufffd\ufffd?\ufffd\ufffd\u0003\ufffd?\ufffdV\ufffd\u0019\ufffd\ufffd&\ufffd8\ufffd\ufffd\u0014\ufffdgA\ufffdH+\ufffd\/\ufffd\ufffd\ufffd3\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 10443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "postgres probe \u00b7 via HTTPS:10443 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\u4270\ufffd\ufffd\ufffd\ufffd\ufffdR\ufffd\ufffdV7:\ufffdK\ufffd\u018eY\ufffd\ufffd\ufffdqw\ufffd \ufffd\ufffd?\ufffd\ufffd\ufffd?\ufffdV\ufffd\ufffd\ufffd&\ufffd8\ufffd\ufffd\ufffdgA\ufffdH+\ufffd\/\ufffd\ufffd\ufffd3\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdA\ufffd", "target_port_label": "10443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "10443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "tls_clienthello" ] }
21/07/2026 14:03:31 UTC	TCP	12443 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:12443 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 6639916abfac56b9 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 12443 Chemin / cible — Service TLS Payload ���&H$<��AبM�~-$�q��,L !ihYl�x1�",Π��ڠ7�h�t<� ��+�/�,�0̨̩� �� A � Pourquoi cette classification :* Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ���&H$<��AبM�~-$�q��,L !ihYl�x1�",Π��ڠ7�h�t<� ��+�/�,�0̨̩� �� A� Requête brute (extrait) ���&H$<��AبM�~-$�q��,L !ihYl�x1�",Π��ڠ7�h�t<� ��+�/�,�0̨̩� �� A � � +3��S�E��853ᢓ�Q�c��D ��'��%�@_QCs��ܣ�oCD� Meta JSON brut { "tls_ja3_hash": "6639916abfac56b9257ca216677085bc", "tls_sni": null, "bytes_in": 1453, "payload_entropy": 7.7836831366556956, "port_category": "registered", "org": "HomeLine Broadband LLC", "service": "tls", "app_proto": "tls", "asn": 213474, "country": "GB", "dst_port": 12443, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "9b4a78ed11b6ca71cc5390b2348cbb98e0882653", "event_fingerprint": "ad4811d163e118b12183ef7797f3990a453ab9d9", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 213474, "org": "HomeLine Broadband LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "6639916abfac56b9257ca216677085bc", "payload_hash": "a080fe35211997c7ca1b0a7d088bfb78", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 12443, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd&H$<\u0010\u001c\ufffd\ufffd\ufffd\u0001A\u0628M\ufffd~-$\ufffd\u0015q\ufffd\ufffd\ufffd\ufffd\ufffd,L !ihYl\ufffdx\u00191\ufffd\",\u0001\u03a0\ufffd\ufffd\u06a07\u0017\ufffd\u0014h\ufffdt<\ufffd \ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd&H$<\u0010\u001c\ufffd\ufffd\ufffd\u0001A\u0628M\ufffd~-$\ufffd\u0015q\ufffd\ufffd\ufffd\ufffd\ufffd,L !ihYl\ufffdx\u00191\ufffd\",\u0001\u03a0\ufffd\ufffd\u06a07\u0017\ufffd\u0014h\ufffdt<\ufffd \ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdS\ufffdE\ufffd\ufffd\u0006\ufffd\u001e\ufffd853\u1893\ufffdQ\ufffdc\ufffd\ufffd\u0002D \ufffd\ufffd\u000e\ufffd'\ufffd\ufffd\ufffd\ufffd%\ufffd@_Q\u001bCs\u0000\ufffd\ufffd\u0723\ufffdoCD\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd&H$<\u0010\u001c\ufffd\ufffd\ufffd\u0001A\u0628M\ufffd~-$\ufffd\u0015q\ufffd\ufffd\ufffd\ufffd\ufffd,L !ihYl\ufffdx\u00191\ufffd\",\u0001\u03a0\ufffd\ufffd\u06a07\u0017\ufffd\u0014h\ufffdt<\ufffd \ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "88da5fa1799533d88200ef818839f03c4508dd17", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd&H$<\u0010\u001c\ufffd\ufffd\ufffd\u0001A\u0628M\ufffd~-$\ufffd\u0015q\ufffd\ufffd\ufffd\ufffd\ufffd,L !ihYl\ufffdx\u00191\ufffd\",\u0001\u03a0\ufffd\ufffd\u06a07\u0017\ufffd\u0014h\ufffdt<\ufffd \ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "6639916abfac56b9257ca216677085bc", "port": 12443, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd&H$<\ufffd\ufffd\ufffdA\u0628M\ufffd~-$\ufffdq\ufffd\ufffd\ufffd\ufffd\ufffd,L !ihYl\ufffdx1\ufffd\",\u03a0\ufffd\ufffd\u06a07\ufffdh\ufffdt<\ufffd \ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdA\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:12443 \u00b7 (sonde \/ probe)", "target_port_label": "12443 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 12443, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffd\ufffd&H$<\u0010\u001c\ufffd\ufffd\ufffd\u0001A\u0628M\ufffd~-$\ufffd\u0015q\ufffd\ufffd\ufffd\ufffd\ufffd,L !ihYl\ufffdx\u00191\ufffd\",\u0001\u03a0\ufffd\ufffd\u06a07\u0017\ufffd\u0014h\ufffdt<\ufffd \ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "6639916abfac56b9257ca216677085bc", "port": 12443, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:12443 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd*\ufffd&H$<\ufffd\ufffd\ufffdA\u0628M\ufffd~-$\ufffdq\ufffd\ufffd\ufffd\ufffd\ufffd,L !ihYl\ufffdx1\ufffd\",\u03a0\ufffd\ufffd\u06a07\ufffdh\ufffdt<\ufffd \ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdA\ufffd", "target_port_label": "12443 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "12443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "https-alt-20443", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
21/07/2026 13:59:38 UTC	TCP	20443 · HTTPS ALT 20443	https-alt-20443	Sonde PostgreSQL postgres probe · via HTTPS ALT 20443:20443 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur HTTPS-ALT-20443 WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 20443 Chemin / cible — Service HTTPS ALT 20443 Payload ��ub�t�>��u��ϋ��q�$��y �?��뼄DR��?�� m�3�s7�~��+�/�,�0̨̩� �� A � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��ub�t�>��u��ϋ��q�$��y �?��뼄DR��?�� m�3�s7�~��+�/�,�0̨̩� �� A� Requête brute (extrait) ��ub�t�>��u��ϋ��q�$��y �?��뼄DR��?�� m�3�s7�~��+�/�,�0̨̩� �� A � � +3��Ia�� EC; k&� �Q�dբ��9��<?�l^R��]��A��H� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 1453, "payload_entropy": 7.748484924474979, "port_category": "registered", "org": "HomeLine Broadband LLC", "service": "https-alt-20443", "app_proto": "https-alt-20443", "asn": 213474, "country": "GB", "dst_port": 20443, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "b9ff0d5ba6597294c5519a4ed0a629f58fb4896a", "event_fingerprint": "a9ec10e4a5e77a82c4a7a417b7d7469fc1f1ab24", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "https-alt-20443", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 213474, "org": "HomeLine Broadband LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bba128e215f0c6ddf5f02443ce684e41", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 20443, "service": "https-alt-20443", "service_name": "https-alt-20443", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdub\ufffd\u0011t\ufffd>\ufffd\u001f\ufffdu\ufffd\ufffd\ufffd\u03cb\ufffd\ufffd\ufffdq\ufffd$\u0004\ufffd\ufffd\ufffd\ufffdy \u001b\ufffd?\ufffd\ufffd\ubf04D\u000f\u001bR\ufffd\ufffd?\u001b\ufffd\ufffd\u0002\r\ufffdm\ufffd3\ufffds7\ufffd~\ufffd\u001e\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdub\ufffd\u0011t\ufffd>\ufffd\u001f\ufffdu\ufffd\ufffd\ufffd\u03cb\ufffd\ufffd\ufffdq\ufffd$\u0004\ufffd\ufffd\ufffd\ufffdy \u001b\ufffd?\ufffd\ufffd\ubf04D\u000f\u001bR\ufffd\ufffd?\u001b\ufffd\ufffd\u0002\r\ufffdm\ufffd3\ufffds7\ufffd~\ufffd\u001e\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdIa\ufffd\ufffd\u000b\ufffdEC;\u0003\rk&\u001d\ufffd\t\u000f\u0013\ufffdQ\ufffdd\u0562\u001a\ufffd\ufffd9\ufffd\ufffd<?\ufffdl^\u0007R\ufffd\ufffd\u0001\u001a\ufffd\ufffd\ufffd]\ufffd\ufffdA\ufffd\ufffdH\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdub\ufffd\u0011t\ufffd>\ufffd\u001f\ufffdu\ufffd\ufffd\ufffd\u03cb\ufffd\ufffd\ufffdq\ufffd$\u0004\ufffd\ufffd\ufffd\ufffdy \u001b\ufffd?\ufffd\ufffd\ubf04D\u000f\u001bR\ufffd\ufffd?\u001b\ufffd\ufffd\u0002\r\ufffdm\ufffd3\ufffds7\ufffd~\ufffd\u001e\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "551ff820da6c7d1478040bf717b9a5815dce3794", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdub\ufffd\u0011t\ufffd>\ufffd\u001f\ufffdu\ufffd\ufffd\ufffd\u03cb\ufffd\ufffd\ufffdq\ufffd$\u0004\ufffd\ufffd\ufffd\ufffdy \u001b\ufffd?\ufffd\ufffd\ubf04D\u000f\u001bR\ufffd\ufffd?\u001b\ufffd\ufffd\u0002\r\ufffdm\ufffd3\ufffds7\ufffd~\ufffd\u001e\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 20443, "service": "https-alt-20443", "service_label_fr": "HTTPS ALT 20443" }, "evidence_snippet": "\ufffd\ufffd\ufffdub\ufffdt\ufffd>\ufffd\ufffdu\ufffd\ufffd\ufffd\u03cb\ufffd\ufffd\ufffdq\ufffd$\ufffd\ufffd\ufffd\ufffdy \ufffd?\ufffd\ufffd\ubf04DR\ufffd\ufffd?\ufffd\ufffd\r\ufffdm\ufffd3\ufffds7\ufffd~\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdA\ufffd", "attack_vector": "postgres probe \u00b7 via HTTPS ALT 20443:20443 \u00b7 (sonde \/ probe)", "target_port_label": "20443 \u00b7 HTTPS ALT 20443", "emulator_service": "https-alt-20443", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "https-alt-20443", "service_label_fr": "HTTPS ALT 20443", "dst_port": 20443, "protocol_emulated": true, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https-alt-20443", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdub\ufffd\u0011t\ufffd>\ufffd\u001f\ufffdu\ufffd\ufffd\ufffd\u03cb\ufffd\ufffd\ufffdq\ufffd$\u0004\ufffd\ufffd\ufffd\ufffdy \u001b\ufffd?\ufffd\ufffd\ubf04D\u000f\u001bR\ufffd\ufffd?\u001b\ufffd\ufffd\u0002\r\ufffdm\ufffd3\ufffds7\ufffd~\ufffd\u001e\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "port": 20443, "service": "https-alt-20443", "service_label_fr": "HTTPS ALT 20443" }, "attack_vector": "postgres probe \u00b7 via HTTPS ALT 20443:20443 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdub\ufffdt\ufffd>\ufffd\ufffdu\ufffd\ufffd\ufffd\u03cb\ufffd\ufffd\ufffdq\ufffd$\ufffd\ufffd\ufffd\ufffdy \ufffd?\ufffd\ufffd\ubf04DR\ufffd\ufffd?\ufffd\ufffd\r\ufffdm\ufffd3\ufffds7\ufffd~\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdA\ufffd", "target_port_label": "20443 \u00b7 HTTPS ALT 20443", "emulator_service": "https-alt-20443", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https_alt_20443", "service_banner": "honeypot-https-alt-20443", "service_os": "linux", "dst_port": "20443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "https-alt-20443", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_clienthello" ] }
21/07/2026 13:55:41 UTC	TCP	17443 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:17443 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 6639916abfac56b9 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 17443 Chemin / cible — Service TLS Payload ��K,6YƅX�Ӡ-�7�-+�q��m�� WN4ܶ\|B�6Y ǟ�]$ �6��1��웿!��+�/�,�0̨̩� �� A � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��K,6YƅX�Ӡ-�7�-+�q��m�� WN4ܶ\|B�6Yǟ�]$�6��1��웿!��+�/�,�0̨̩� �� A� Requête brute (extrait) ��K,6YƅX�Ӡ-�7�-+�q��m�� WN4ܶ\|B�6Y ǟ�]$ �6��1��웿!��+�/�,�0̨̩� �� A � � +3��R8{9=�Q��l�0��k�d6�p�Z��{�M�� s�ss�3?3�� Meta JSON brut { "tls_ja3_hash": "6639916abfac56b9257ca216677085bc", "tls_sni": null, "bytes_in": 1453, "payload_entropy": 7.71213356569596, "port_category": "registered", "org": "HomeLine Broadband LLC", "service": "tls", "app_proto": "tls", "asn": 213474, "country": "GB", "dst_port": 17443, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "5c580e51cbe53114636d2ea5067b5c5ba2b60555", "event_fingerprint": "cc86c6279e382ef5fcc924cf7ddda3d14d637549", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "GB", "asn": 213474, "org": "HomeLine Broadband LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "6639916abfac56b9257ca216677085bc", "payload_hash": "f3440d9a939939380ff35c881eb8e2da", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 17443, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdK\u0002\u001d,6Y\u0185X\u0001\u0010\ufffd\u04e0-\ufffd7\ufffd-+\ufffdq\ufffd\ufffd\bm\ufffd\ufffd\ufffd\r\ufffd WN4\u0736\|B\ufffd6Y\f\u0010\u01df\ufffd]$\u000b\ufffd6\ufffd\ufffd1\ufffd\ufffd\u0001\ufffd\uc6ff!\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdK\u0002\u001d,6Y\u0185X\u0001\u0010\ufffd\u04e0-\ufffd7\ufffd-+\ufffdq\ufffd\ufffd\bm\ufffd\ufffd\ufffd\r\ufffd WN4\u0736\|B\ufffd6Y\f\u0010\u01df\ufffd]$\u000b\ufffd6\ufffd\ufffd1\ufffd\ufffd\u0001\ufffd\uc6ff!\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdR8\u001a{9=\ufffdQ\ufffd\ufffd\ufffd\u0002\u001d\ufffdl\ufffd0\ufffd\u001b\ufffdk\ufffdd6\ufffd\u0001\u0013p\ufffdZ\u0000\ufffd\ufffd{\ufffdM\ufffd\ufffd\ufffd\ufffd\ufffd\f\ufffd\ufffds\u000f\ufffdss\ufffd3?3\ufffd\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdK\u0002\u001d,6Y\u0185X\u0001\u0010\ufffd\u04e0-\ufffd7\ufffd-+\ufffdq\ufffd\ufffd\bm\ufffd\ufffd\ufffd\r\ufffd WN4\u0736\|B\ufffd6Y\f\u0010\u01df\ufffd]$\u000b\ufffd6\ufffd\ufffd1\ufffd\ufffd\u0001\ufffd\uc6ff!\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "28e2f53bae2671cbda9cf76d36b42bf6d2934d33", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdK\u0002\u001d,6Y\u0185X\u0001\u0010\ufffd\u04e0-\ufffd7\ufffd-+\ufffdq\ufffd\ufffd\bm\ufffd\ufffd\ufffd\r\ufffd WN4\u0736\|B\ufffd6Y\f\u0010\u01df\ufffd]$\u000b\ufffd6\ufffd\ufffd1\ufffd\ufffd\u0001\ufffd\uc6ff!\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "6639916abfac56b9257ca216677085bc", "port": 17443, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdK,6Y\u0185X\ufffd\u04e0-\ufffd7\ufffd-+\ufffdq\ufffd\ufffdm\ufffd\ufffd\ufffd\r\ufffd WN4\u0736\|B\ufffd6Y\u01df\ufffd]$\ufffd6\ufffd\ufffd1\ufffd\ufffd\ufffd\uc6ff!\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdA\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:17443 \u00b7 (sonde \/ probe)", "target_port_label": "17443 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 17443, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffdK\u0002\u001d,6Y\u0185X\u0001\u0010\ufffd\u04e0-\ufffd7\ufffd-+\ufffdq\ufffd\ufffd\bm\ufffd\ufffd\ufffd\r\ufffd WN4\u0736\|B\ufffd6Y\f\u0010\u01df\ufffd]$\u000b\ufffd6\ufffd\ufffd1\ufffd\ufffd\u0001\ufffd\uc6ff!\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005A\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "6639916abfac56b9257ca216677085bc", "port": 17443, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:17443 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdK,6Y\u0185X\ufffd\u04e0-\ufffd7\ufffd-+\ufffdq\ufffd\ufffdm\ufffd\ufffd\ufffd\r\ufffd WN4\u0736\|B\ufffd6Y\u01df\ufffd]$\ufffd6\ufffd\ufffd1\ufffd\ufffd\ufffd\uc6ff!\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdA\ufffd", "target_port_label": "17443 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "17443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }

Réputation

Sécurité avancée

Offensive / Recon

Sécurité

DNS

Réseau

E-mail

IP

Utilitaires

138.226.239.90

Profil de menace

Pourquoi listée

Comparaison ASN / FAI

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence