{"ip":"151.243.11.203","exported_at":"2026-10-24T18:00:56+00:00","period_days":30,"metrics":{"events7d":134,"distinct_ports":3,"distinct_classifications":8,"max_severity":9,"last_sensor_id":"paris-1","max_waf_score":19,"max_risk_score":54,"attack_stage":"probe","attack_chain_stage":"reconnaissance","threat_family":["scanner","IP malveillante (CINS Army)"],"recommended_action":"monitor","confidence":0.95,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":43,"novelty":15},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0001","top_mitre_count":79,"executive_one_liner_fr":"Activit\u00e9 suspecte \u00b7 risque 40\/100","campaign_hint_fr":"Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)","confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":40,"correlation_boost":18},"persona_hostname":"mail.sensor-1.internal","correlation_flags":["scan_coordonn\u00e9","multi_protocol_correlation"],"correlation_flags_labels_fr":["Scan coordonn\u00e9","Multi-protocole corr\u00e9l\u00e9 (5 min)"],"confidence_pct":95,"confidence_hint_fr":"Corr\u00e9lation +18","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":[],"tags_summary":[],"attack_vector":"Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 51.222.140.50:443","protocol_details":{"http_method":"CONNECT","http_path":"51.222.140.50:443","request_line":"CONNECT 51.222.140.50:443 HTTP\/1.1","port":8082,"service":"http","service_label_fr":"HTTP"},"protocol_summary_fr":"CONNECT 51.222.140.50:443 \u00b7 HTTP:8082","evidence_snippet":"CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: 51.222.140.50:443\r\nProxy-Connection: Keep-Alive","target_port_label":"8082 \u00b7 HTTP","emulator_service":"http","confidence_reason":"Confiance 77 % \u2014 Score WAF 8","classification_reason":"Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%","classification_reason_label_fr":"Type \u00ab Sonde HTTP \u00bb (signaux protocolaires) \u00b7 confiance 77%","confidence_factors_fr":"Confiance 95 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18","payload_preview":"CONNECT 51.222.140.50:443 HTTP\/1.1\r\nHost: 51.222.140.50:443\r\nProxy-Connection: Keep-Alive","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":true,"label_fr":"IP malveillante (CINS Army)","detail_fr":null}},"dnsbl":{"query":"203.11.243.151.dnsbl.blacklistip.com","listed":false,"available":false,"response":null,"meaning":null,"label":null},"events":[{"id":7664328,"ip":"151.243.11.203","ts":"2026-10-24 12:21:05.000000","proto":"tcp","src_port":57160,"dst_port":8082,"service":"http","classification":"web_probe","waf_score":0,"waf_tags":"[]","http_method":"CONNECT","http_target":"51.222.140.50:443","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 2, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u002250:443\u0022, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: \u002279e1fcb6ff660e82fad8f544dcaf26be4eb2ab92\u0022, \u0022http_target_hash\u0022: \u002279e1fcb6ff660e82fad8f544dcaf26be4eb2ab92\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 93, \u0022payload_entropy\u0022: 4.83544405870078, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8082, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 40, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022de4b792978daffc657a96afe3825931666ed7cf4\u0022, \u0022event_fingerprint\u0022: \u0022797fa0abdb81d4577b727bb68a3729b6b581acbf\u0022, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224da1a47669bd843fb28aa1f5605950ac\u0022, \u0022path_pattern_hash\u0022: \u00228e97e814394b1ee58905a3d6643b201d\u0022}, \u0022service_name\u0022: \u0022http\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8082, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 40}, \u0022payload_preview\u0022: \u0022CONNECT 51.222.140.50:443 HTTP\/1.1\\r\\nHost: 51.222.140.50:443\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022CONNECT\u0022, \u0022path\u0022: \u002251.222.140.50:443\u0022, \u0022request_line\u0022: \u0022CONNECT 51.222.140.50:443 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022CONNECT 51.222.140.50:443 HTTP\/1.1\\r\\nHost: 51.222.140.50:443\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022CONNECT 51.222.140.50:443 HTTP\/1.1\\r\\nHost: 51.222.140.50:443\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022CONNECT\u0022, \u0022path\u0022: \u002251.222.140.50:443\u0022, \u0022request_line\u0022: \u0022CONNECT 51.222.140.50:443 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022CONNECT 51.222.140.50:443 HTTP\/1.1\\r\\nHost: 51.222.140.50:443\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022CONNECT 51.222.140.50:443 HTTP\/1.1\\r\\nHost: 51.222.140.50:443\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022}, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022aa527f209dfc6655e68f3504a4f3566e36486049\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_path\u0022: \u002251.222.140.50:443\u0022, \u0022request_line\u0022: \u0022CONNECT 51.222.140.50:443 HTTP\/1.1\u0022, \u0022port\u0022: 8082, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022CONNECT 51.222.140.50:443 HTTP\/1.1\\r\\nHost: 51.222.140.50:443\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 51.222.140.50:443\u0022, \u0022target_port_label\u0022: \u00228082 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 77 % \u2014 Score WAF 8\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 40\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 40, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8082, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_path\u0022: \u002251.222.140.50:443\u0022, \u0022request_line\u0022: \u0022CONNECT 51.222.140.50:443 HTTP\/1.1\u0022, \u0022port\u0022: 8082, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 51.222.140.50:443\u0022, \u0022evidence_snippet\u0022: \u0022CONNECT 51.222.140.50:443 HTTP\/1.1\\r\\nHost: 51.222.140.50:443\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022target_port_label\u0022: \u00228082 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 77 % \u2014 Score WAF 8\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228082\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8082\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 10, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_dangerous_method\u0022, \u0022http_method_uncommon\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"51.222.140.50:443","http_user_agent":null,"http_referer":null,"tags":"[\u0022http_dangerous_method\u0022, \u0022http_method_uncommon\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":93},{"id":7664319,"ip":"151.243.11.203","ts":"2026-10-24 12:21:05.000000","proto":"tcp","src_port":57156,"dst_port":8082,"service":"http","classification":"web_probe","waf_score":0,"waf_tags":"[]","http_method":"CONNECT","http_target":"51.195.40.238:443","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 2, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022238:443\u0022, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: \u0022032a6b265d7be5d94b3c66ccf1134f77f9ac161b\u0022, \u0022http_target_hash\u0022: \u0022032a6b265d7be5d94b3c66ccf1134f77f9ac161b\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 93, \u0022payload_entropy\u0022: 4.937699703908597, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8082, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 40, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022de4b792978daffc657a96afe3825931666ed7cf4\u0022, \u0022event_fingerprint\u0022: \u002219d9019624dd6311c6767cd05e7e3acf9d29da79\u0022, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002236b5246d569e179832b765c65582d1f2\u0022, \u0022path_pattern_hash\u0022: \u00221efeb63784d228978fff6ef7cb8cefe7\u0022}, \u0022service_name\u0022: \u0022http\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8082, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 40}, \u0022payload_preview\u0022: \u0022CONNECT 51.195.40.238:443 HTTP\/1.1\\r\\nHost: 51.195.40.238:443\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022CONNECT\u0022, \u0022path\u0022: \u002251.195.40.238:443\u0022, \u0022request_line\u0022: \u0022CONNECT 51.195.40.238:443 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022CONNECT 51.195.40.238:443 HTTP\/1.1\\r\\nHost: 51.195.40.238:443\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022CONNECT 51.195.40.238:443 HTTP\/1.1\\r\\nHost: 51.195.40.238:443\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022CONNECT\u0022, \u0022path\u0022: \u002251.195.40.238:443\u0022, \u0022request_line\u0022: \u0022CONNECT 51.195.40.238:443 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022CONNECT 51.195.40.238:443 HTTP\/1.1\\r\\nHost: 51.195.40.238:443\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022CONNECT 51.195.40.238:443 HTTP\/1.1\\r\\nHost: 51.195.40.238:443\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022}, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f8a29adf2a3f8438ae3581908d8253c9c82c53a5\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_path\u0022: \u002251.195.40.238:443\u0022, \u0022request_line\u0022: \u0022CONNECT 51.195.40.238:443 HTTP\/1.1\u0022, \u0022port\u0022: 8082, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022CONNECT 51.195.40.238:443 HTTP\/1.1\\r\\nHost: 51.195.40.238:443\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 51.195.40.238:443\u0022, \u0022target_port_label\u0022: \u00228082 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 77 % \u2014 Score WAF 8\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 40\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 40, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8082, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_path\u0022: \u002251.195.40.238:443\u0022, \u0022request_line\u0022: \u0022CONNECT 51.195.40.238:443 HTTP\/1.1\u0022, \u0022port\u0022: 8082, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 51.195.40.238:443\u0022, \u0022evidence_snippet\u0022: \u0022CONNECT 51.195.40.238:443 HTTP\/1.1\\r\\nHost: 51.195.40.238:443\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022target_port_label\u0022: \u00228082 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 77 % \u2014 Score WAF 8\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228082\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8082\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 10, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_dangerous_method\u0022, \u0022http_method_uncommon\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"51.195.40.238:443","http_user_agent":null,"http_referer":null,"tags":"[\u0022http_dangerous_method\u0022, \u0022http_method_uncommon\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":93},{"id":7664289,"ip":"151.243.11.203","ts":"2026-10-24 12:21:03.000000","proto":"tcp","src_port":57124,"dst_port":8082,"service":"http","classification":"web_probe","waf_score":0,"waf_tags":"[]","http_method":"CONNECT","http_target":"tooyoungtoholdon.world:443","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 2, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: \u0022c30803427f3dc364cbddb6ff6340fd0b5705b1d1\u0022, \u0022http_target_hash\u0022: \u0022c30803427f3dc364cbddb6ff6340fd0b5705b1d1\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 111, \u0022payload_entropy\u0022: 4.779965528783029, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8082, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 40, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022de4b792978daffc657a96afe3825931666ed7cf4\u0022, \u0022event_fingerprint\u0022: \u00224809545e53344a1ec7aac85549096e78217b5bd7\u0022, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022b1a8df419af6ad8b62434069611075b7\u0022, \u0022path_pattern_hash\u0022: \u0022fa12dda707d91254be26f26ba41cdab0\u0022}, \u0022service_name\u0022: \u0022http\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8082, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 40}, \u0022payload_preview\u0022: \u0022CONNECT tooyoungtoholdon.world:443 HTTP\/1.1\\r\\nHost: tooyoungtoholdon.world:443\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022CONNECT\u0022, \u0022path\u0022: \u0022tooyoungtoholdon.world:443\u0022, \u0022request_line\u0022: \u0022CONNECT tooyoungtoholdon.world:443 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022CONNECT tooyoungtoholdon.world:443 HTTP\/1.1\\r\\nHost: tooyoungtoholdon.world:443\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022CONNECT tooyoungtoholdon.world:443 HTTP\/1.1\\r\\nHost: tooyoungtoholdon.world:443\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022CONNECT\u0022, \u0022path\u0022: \u0022tooyoungtoholdon.world:443\u0022, \u0022request_line\u0022: \u0022CONNECT tooyoungtoholdon.world:443 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022CONNECT tooyoungtoholdon.world:443 HTTP\/1.1\\r\\nHost: tooyoungtoholdon.world:443\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022CONNECT tooyoungtoholdon.world:443 HTTP\/1.1\\r\\nHost: tooyoungtoholdon.world:443\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022}, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a31cef292609c1ef38c221a4913d9f548ec4237d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_path\u0022: \u0022tooyoungtoholdon.world:443\u0022, \u0022request_line\u0022: \u0022CONNECT tooyoungtoholdon.world:443 HTTP\/1.1\u0022, \u0022port\u0022: 8082, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022CONNECT tooyoungtoholdon.world:443 HTTP\/1.1\\r\\nHost: tooyoungtoholdon.world:443\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 tooyoungtoholdon.world:443\u0022, \u0022target_port_label\u0022: \u00228082 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 77 % \u2014 Score WAF 8\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 40\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 40, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8082, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_path\u0022: \u0022tooyoungtoholdon.world:443\u0022, \u0022request_line\u0022: \u0022CONNECT tooyoungtoholdon.world:443 HTTP\/1.1\u0022, \u0022port\u0022: 8082, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 tooyoungtoholdon.world:443\u0022, \u0022evidence_snippet\u0022: \u0022CONNECT tooyoungtoholdon.world:443 HTTP\/1.1\\r\\nHost: tooyoungtoholdon.world:443\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022target_port_label\u0022: \u00228082 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 77 % \u2014 Score WAF 8\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228082\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8082\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 10, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_dangerous_method\u0022, \u0022http_method_uncommon\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"tooyoungtoholdon.world:443","http_user_agent":null,"http_referer":null,"tags":"[\u0022http_dangerous_method\u0022, \u0022http_method_uncommon\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":111},{"id":7664269,"ip":"151.243.11.203","ts":"2026-10-24 12:21:02.000000","proto":"tcp","src_port":56436,"dst_port":8082,"service":"http","classification":"web_probe","waf_score":0,"waf_tags":"[]","http_method":"CONNECT","http_target":"youshouldvecomeover.lol:443","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 2, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: \u002229850c939d86aa49f111596db156240539826d67\u0022, \u0022http_target_hash\u0022: \u002229850c939d86aa49f111596db156240539826d67\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 113, \u0022payload_entropy\u0022: 4.82174998185034, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8082, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 40, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022de4b792978daffc657a96afe3825931666ed7cf4\u0022, \u0022event_fingerprint\u0022: \u00222a4b940a13012cda89b8db5055ade04e63b5bf9a\u0022, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022e42ecdc252ca7b950e6fc9bcb9749314\u0022, \u0022path_pattern_hash\u0022: \u0022c9dc30d1fdd2c2a13a7eacadd2f42911\u0022}, \u0022service_name\u0022: \u0022http\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8082, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 40}, \u0022payload_preview\u0022: \u0022CONNECT youshouldvecomeover.lol:443 HTTP\/1.1\\r\\nHost: youshouldvecomeover.lol:443\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022CONNECT\u0022, \u0022path\u0022: \u0022youshouldvecomeover.lol:443\u0022, \u0022request_line\u0022: \u0022CONNECT youshouldvecomeover.lol:443 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022CONNECT youshouldvecomeover.lol:443 HTTP\/1.1\\r\\nHost: youshouldvecomeover.lol:443\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022CONNECT youshouldvecomeover.lol:443 HTTP\/1.1\\r\\nHost: youshouldvecomeover.lol:443\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022CONNECT\u0022, \u0022path\u0022: \u0022youshouldvecomeover.lol:443\u0022, \u0022request_line\u0022: \u0022CONNECT youshouldvecomeover.lol:443 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022CONNECT youshouldvecomeover.lol:443 HTTP\/1.1\\r\\nHost: youshouldvecomeover.lol:443\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022CONNECT youshouldvecomeover.lol:443 HTTP\/1.1\\r\\nHost: youshouldvecomeover.lol:443\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022}, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cb2dcd3e2a9fbc99fedca5cdde8903636ddc926c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_path\u0022: \u0022youshouldvecomeover.lol:443\u0022, \u0022request_line\u0022: \u0022CONNECT youshouldvecomeover.lol:443 HTTP\/1.1\u0022, \u0022port\u0022: 8082, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022CONNECT youshouldvecomeover.lol:443 HTTP\/1.1\\r\\nHost: youshouldvecomeover.lol:443\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 youshouldvecomeover.lol:443\u0022, \u0022target_port_label\u0022: \u00228082 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 77 % \u2014 Score WAF 8\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 40\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 40, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8082, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_path\u0022: \u0022youshouldvecomeover.lol:443\u0022, \u0022request_line\u0022: \u0022CONNECT youshouldvecomeover.lol:443 HTTP\/1.1\u0022, \u0022port\u0022: 8082, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:8082 \u00b7 (sonde \/ probe) \u00b7 \u2192 youshouldvecomeover.lol:443\u0022, \u0022evidence_snippet\u0022: \u0022CONNECT youshouldvecomeover.lol:443 HTTP\/1.1\\r\\nHost: youshouldvecomeover.lol:443\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022target_port_label\u0022: \u00228082 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 77 % \u2014 Score WAF 8\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228082\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022http-alt-8082\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 7, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_dangerous_method\u0022, \u0022http_method_uncommon\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"youshouldvecomeover.lol:443","http_user_agent":null,"http_referer":null,"tags":"[\u0022http_dangerous_method\u0022, \u0022http_method_uncommon\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":113},{"id":7664214,"ip":"151.243.11.203","ts":"2026-10-24 12:20:53.000000","proto":"tcp","src_port":42876,"dst_port":8082,"service":"http-alt-8082","classification":"http-alt-8082","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http-alt-8082\u0022, \u0022app_proto\u0022: \u0022http-alt-8082\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 8082, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 0, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022fe1eeea9db4fe10f9c4d29199d71cd915285d71d\u0022, \u0022event_fingerprint\u0022: \u00220e49cbf0cd38e11c005312d70c60a0ee389bb82f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http-alt-8082 \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http-alt-8082\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u0022ab911db9a03f822d13fe3595fc5be734\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8082, \u0022service\u0022: \u0022http-alt-8082\u0022, \u0022service_name\u0022: \u0022http-alt-8082\u0022, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e68a7ea02e189f60ac6563825c3c7f853eb86b82\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 8082, \u0022service\u0022: \u0022http-alt-8082\u0022, \u0022service_label_fr\u0022: \u0022HTTP ALT 8082\u0022}, \u0022attack_vector\u0022: \u0022http-alt-8082 \u00b7 via HTTP ALT 8082:8082 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228082 \u00b7 HTTP ALT 8082\u0022, \u0022emulator_service\u0022: \u0022http-alt-8082\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http-alt-8082 \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http-alt-8082 \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 0}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 0, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http-alt-8082\u0022, \u0022service_label_fr\u0022: \u0022HTTP ALT 8082\u0022, \u0022dst_port\u0022: 8082, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http-alt-8082\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 8082, \u0022service\u0022: \u0022http-alt-8082\u0022, \u0022service_label_fr\u0022: \u0022HTTP ALT 8082\u0022}, \u0022attack_vector\u0022: \u0022http-alt-8082 \u00b7 via HTTP ALT 8082:8082 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00228082 \u00b7 HTTP ALT 8082\u0022, \u0022emulator_service\u0022: \u0022http-alt-8082\u0022, \u0022confidence_reason\u0022: \u0022Confiance faible (0 %) \u2014 classification prudente\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http_alt_8082\u0022, \u0022service_banner\u0022: \u0022honeypot-http-alt-8082\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228082\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":0},{"id":7336050,"ip":"151.243.11.203","ts":"2026-10-23 21:42:38.000000","proto":"tcp","src_port":41278,"dst_port":9000,"service":"http","classification":"slowloris","waf_score":3,"waf_tags":"[\u0022950734:sap-sapcontrol-path\u0022]","http_method":"\u0004\u0001\u0001h\u0015(\u0000","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0004\\u0001\\u0001h\\u0015(\\u0000\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 9, \u0022payload_entropy\u0022: 2.94770277922009, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 20.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 28, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002263c5e9405f72f7a8913b1470efb39675273e20ae\u0022, \u0022event_fingerprint\u0022: \u002205f33efe067250442006cc3f5838234fd3bf6a0e\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.1, \u0022classification_confidence\u0022: 0.1, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 28, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022deab96328757c57430c3da1064ee2174\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 28}, \u0022payload_preview\u0022: \u0022\\u0004\\u0001\\u0001\ufffdh\\u0015(\ufffd\\u0000\u0022, \u0022method\u0022: \u0022\\u0004\\u0001\\u0001h\\u0015(\\u0000\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022waf_tags\u0022: [\u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0001H\\u0015(\\u0000 \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0004\\u0001\\u0001\ufffdh\\u0015(\ufffd\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0004\\u0001\\u0001\ufffdh\\u0015(\ufffd\\u0000\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0004\\u0001\\u0001h\\u0015(\\u0000\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022waf_tags\u0022: [\u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0001H\\u0015(\\u0000 \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0004\\u0001\\u0001\ufffdh\\u0015(\ufffd\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0004\\u0001\\u0001\ufffdh\\u0015(\ufffd\\u0000\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ba8a62787757b2f4b6607cc9ea091c6db629a3d0\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0004\\u0001\\u0001h\\u0015(\\u0000\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0001H\\u0015(\\u0000 \/ HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdh(\ufffd\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 28\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 10 % \u2014 via HTTP \u2014 campagne \/24 (151.243.11.0\/24)\u0022, \u0022confidence_pct\u0022: 10, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 28, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 28, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0004\\u0001\\u0001h\\u0015(\\u0000\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0001H\\u0015(\\u0000 \/ HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdh(\ufffd\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 10 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +10 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 10, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950734:sap-sapcontrol-path\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022], \u0022behavior_alert_count\u0022: 2, \u0022behavior_priority\u0022: 84}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.0","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022950734:sap-sapcontrol-path\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":9},{"id":7336029,"ip":"151.243.11.203","ts":"2026-10-23 21:42:37.000000","proto":"tcp","src_port":41260,"dst_port":9000,"service":"http","classification":"web_probe","waf_score":3,"waf_tags":"[\u0022950734:sap-sapcontrol-path\u0022]","http_method":"\u0004\u0001\u0001Cc\u0000","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0004\\u0001\\u0001Cc\\u0000\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 9, \u0022payload_entropy\u0022: 2.94770277922009, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 20.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 40, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b88129750b5b2e048493e7a7d4155bb7a4b6a630\u0022, \u0022event_fingerprint\u0022: \u002205f33efe067250442006cc3f5838234fd3bf6a0e\u0022, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022df8005337761b32b101374e3ff5ece90\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022service_name\u0022: \u0022http\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 40}, \u0022payload_preview\u0022: \u0022\\u0004\\u0001\\u0001\ufffd\ufffdC\ufffdc\\u0000\u0022, \u0022method\u0022: \u0022\\u0004\\u0001\\u0001Cc\\u0000\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022waf_tags\u0022: [\u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0001CC\\u0000 \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0004\\u0001\\u0001\ufffd\ufffdC\ufffdc\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0004\\u0001\\u0001\ufffd\ufffdC\ufffdc\\u0000\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0004\\u0001\\u0001Cc\\u0000\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022waf_tags\u0022: [\u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0001CC\\u0000 \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0004\\u0001\\u0001\ufffd\ufffdC\ufffdc\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0004\\u0001\\u0001\ufffd\ufffdC\ufffdc\\u0000\u0022, \u0022classification_reason\u0022: \u0022Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%\u0022}, \u0022classification_reason\u0022: \u0022Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022confidence\u0022: 0.84, \u0022classification_confidence\u0022: 0.84, \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d1a850dc2f4fb5a3c3359597a552e32b12344314\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0004\\u0001\\u0001Cc\\u0000\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0001CC\\u0000 \/ HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdC\ufffdc\u0022, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 40\/100\u0022, \u0022confidence_pct\u0022: 84, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 40, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0004\\u0001\\u0001Cc\\u0000\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0001CC\\u0000 \/ HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdC\ufffdc\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 84 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +10 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 10, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950734:sap-sapcontrol-path\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.0","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022950734:sap-sapcontrol-path\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":9},{"id":7336008,"ip":"151.243.11.203","ts":"2026-10-23 21:42:37.000000","proto":"tcp","src_port":41244,"dst_port":9000,"service":"http","classification":"web_probe","waf_score":3,"waf_tags":"[\u0022950734:sap-sapcontrol-path\u0022]","http_method":"\u0004\u0001\u0001h\u0015(\u0000","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0004\\u0001\\u0001h\\u0015(\\u0000\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 9, \u0022payload_entropy\u0022: 2.94770277922009, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 20.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 40, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b88129750b5b2e048493e7a7d4155bb7a4b6a630\u0022, \u0022event_fingerprint\u0022: \u002205f33efe067250442006cc3f5838234fd3bf6a0e\u0022, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022deab96328757c57430c3da1064ee2174\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022service_name\u0022: \u0022http\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 40}, \u0022payload_preview\u0022: \u0022\\u0004\\u0001\\u0001\ufffdh\\u0015(\ufffd\\u0000\u0022, \u0022method\u0022: \u0022\\u0004\\u0001\\u0001h\\u0015(\\u0000\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022waf_tags\u0022: [\u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0001H\\u0015(\\u0000 \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0004\\u0001\\u0001\ufffdh\\u0015(\ufffd\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0004\\u0001\\u0001\ufffdh\\u0015(\ufffd\\u0000\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0004\\u0001\\u0001h\\u0015(\\u0000\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022waf_tags\u0022: [\u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0001H\\u0015(\\u0000 \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0004\\u0001\\u0001\ufffdh\\u0015(\ufffd\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0004\\u0001\\u0001\ufffdh\\u0015(\ufffd\\u0000\u0022, \u0022classification_reason\u0022: \u0022Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%\u0022}, \u0022classification_reason\u0022: \u0022Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022confidence\u0022: 0.84, \u0022classification_confidence\u0022: 0.84, \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022300df663dac2be16135d5565f69fa4a9f8fdbf81\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0004\\u0001\\u0001h\\u0015(\\u0000\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0001H\\u0015(\\u0000 \/ HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffdh(\ufffd\u0022, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 40\/100\u0022, \u0022confidence_pct\u0022: 84, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 40, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0004\\u0001\\u0001h\\u0015(\\u0000\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0001H\\u0015(\\u0000 \/ HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffdh(\ufffd\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 84 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +10 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 3, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950734:sap-sapcontrol-path\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.0","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022950734:sap-sapcontrol-path\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":9},{"id":7282293,"ip":"151.243.11.203","ts":"2026-10-23 19:07:42.000000","proto":"tcp","src_port":53600,"dst_port":9000,"service":"http","classification":"exploit_attempt","waf_score":19,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/c\/2gzUEEdn8vcp5lbP5RHMHJCTn-37x-U48bX6hGMyJJkHSzAjEhFhB0ctAp1-ru4dCJKcvEMqFlcUvtMSbe7_byCUvDmAR0OL","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 7, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002208bcdb8b5addbb80b0dcf079559495f42e13bcbd\u0022, \u0022http_host_hash\u0022: \u0022005c7dc11b2da7269181a8949bfa888f74c4feb2\u0022, \u0022http_target_hash\u0022: \u0022abc6eaf60e082c30b175c39fc435162f726b7110\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 490, \u0022payload_entropy\u0022: 5.695494016253155, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 84.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 49, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022453498e87e825cecea3232558f84c7576c449cac\u0022, \u0022event_fingerprint\u0022: \u002206496216f9a08b3e0a2263b8d312d608f8482c69\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.72, \u0022classification_confidence\u0022: 0.72, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022a9f3741623f5311a5459a431968528ad\u0022, \u0022payload_hash\u0022: \u0022ee13e153fdf8c43b19083eea448a2087\u0022, \u0022path_pattern_hash\u0022: \u002248beee4b1769112328ff14141b2ef5b1\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 49}, \u0022payload_preview\u0022: \u0022GET \/c\/2gzUEEdn8vcp5lbP5RHMHJCTn-37x-U48bX6hGMyJJkHSzAjEhFhB0ctAp1-ru4dCJKcvEMqFlcUvtMSbe7_byCUvDmAR0OL HTTP\/1.1\\r\\nhost: tooyoung\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/c\/2gzUEEdn8vcp5lbP5RHMHJCTn-37x-U48bX6hGMyJJkHSzAjEhFhB0ctAp1-ru4dCJKcvEMqFlcUvtMSbe7_byCUvDmAR0OL\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/c\/2gzUEEdn8vcp5lbP5RHMHJCTn-37x-U48bX6hGMyJJkHSzAjEhFhB0ctAp1-ru4dCJKcvEMqFlcUvtMSbe7_byCUvDmAR0OL HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/c\/2gzUEEdn8vcp5lbP5RHMHJCTn-37x-U48bX6hGMyJJkHSzAjEhFhB0ctAp1-ru4dCJKcvEMqFlcUvtMSbe7_byCUvDmAR0OL HTTP\/1.1\\r\\nhost: tooyoungtoholdon.world\\r\\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Sa\u0022, \u0022payload_snippet\u0022: \u0022GET \/c\/2gzUEEdn8vcp5lbP5RHMHJCTn-37x-U48bX6hGMyJJkHSzAjEhFhB0ctAp1-ru4dCJKcvEMqFlcUvtMSbe7_byCUvDmAR0OL HTTP\/1.1\\r\\nhost: tooyoung\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/c\/2gzUEEdn8vcp5lbP5RHMHJCTn-37x-U48bX6hGMyJJkHSzAjEhFhB0ctAp1-ru4dCJKcvEMqFlcUvtMSbe7_byCUvDmAR0OL\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/c\/2gzUEEdn8vcp5lbP5RHMHJCTn-37x-U48bX6hGMyJJkHSzAjEhFhB0ctAp1-ru4dCJKcvEMqFlcUvtMSbe7_byCUvDmAR0OL HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/c\/2gzUEEdn8vcp5lbP5RHMHJCTn-37x-U48bX6hGMyJJkHSzAjEhFhB0ctAp1-ru4dCJKcvEMqFlcUvtMSbe7_byCUvDmAR0OL HTTP\/1.1\\r\\nhost: tooyoungtoholdon.world\\r\\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Sa\u0022, \u0022payload_snippet\u0022: \u0022GET \/c\/2gzUEEdn8vcp5lbP5RHMHJCTn-37x-U48bX6hGMyJJkHSzAjEhFhB0ctAp1-ru4dCJKcvEMqFlcUvtMSbe7_byCUvDmAR0OL HTTP\/1.1\\r\\nhost: tooyoung\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c77b31193d99255f968813e701c785ed1e517435\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/c\/2gzUEEdn8vcp5lbP5RHMHJCTn-37x-U48bX6hGMyJJkHSzAjEhFhB0ctAp1-ru4dCJKcvEMqFlcUvtMSbe7_byCUvDmAR0OL\u0022, \u0022request_line\u0022: \u0022GET \/c\/2gzUEEdn8vcp5lbP5RHMHJCTn-37x-U48bX6hGMyJJkHSzAjEhFhB0ctAp1-ru4dCJKcvEMqFlcUvtMSbe7_byCUvDmAR0OL HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/c\/2gzUEEdn8vcp5lbP5RHMHJCTn-37x-U48bX6hGMyJJkHSzAjEhFhB0ctAp1-ru4dCJKcvEMqFlcUvtMSbe7_byCUvDmAR0OL HTTP\/1.1\\r\\nhost: tooyoung\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/c\/2gzUEEdn8vcp5lbP5RHMHJCTn-37x-U48bX6hGMyJJkH\u2026\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 campagne \/24 (151.243.11.0\/24)\u0022, \u0022confidence_pct\u0022: 72, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 49, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/c\/2gzUEEdn8vcp5lbP5RHMHJCTn-37x-U48bX6hGMyJJkHSzAjEhFhB0ctAp1-ru4dCJKcvEMqFlcUvtMSbe7_byCUvDmAR0OL\u0022, \u0022request_line\u0022: \u0022GET \/c\/2gzUEEdn8vcp5lbP5RHMHJCTn-37x-U48bX6hGMyJJkHSzAjEhFhB0ctAp1-ru4dCJKcvEMqFlcUvtMSbe7_byCUvDmAR0OL HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/c\/2gzUEEdn8vcp5lbP5RHMHJCTn-37x-U48bX6hGMyJJkH\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/c\/2gzUEEdn8vcp5lbP5RHMHJCTn-37x-U48bX6hGMyJJkHSzAjEhFhB0ctAp1-ru4dCJKcvEMqFlcUvtMSbe7_byCUvDmAR0OL HTTP\/1.1\\r\\nhost: tooyoung\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 72 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 10, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"tooyoungtoholdon.world","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":9,"bytes_in":490},{"id":7282289,"ip":"151.243.11.203","ts":"2026-10-23 19:07:41.000000","proto":"tcp","src_port":53588,"dst_port":9000,"service":"http","classification":"slowloris","waf_score":3,"waf_tags":"[\u0022950734:sap-sapcontrol-path\u0022]","http_method":"\u0004\u0001\u0000Ph\u0015(\u0000","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0004\\u0001\\u0000Ph\\u0015(\\u0000\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 9, \u0022payload_entropy\u0022: 2.94770277922009, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 20.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 28, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002263c5e9405f72f7a8913b1470efb39675273e20ae\u0022, \u0022event_fingerprint\u0022: \u002205f33efe067250442006cc3f5838234fd3bf6a0e\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.1, \u0022classification_confidence\u0022: 0.1, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 28, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022503edac9d6129a84cc854f57188a2944\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 28}, \u0022payload_preview\u0022: \u0022\\u0004\\u0001\\u0000Ph\\u0015(\ufffd\\u0000\u0022, \u0022method\u0022: \u0022\\u0004\\u0001\\u0000Ph\\u0015(\\u0000\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022waf_tags\u0022: [\u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0000PH\\u0015(\\u0000 \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0004\\u0001\\u0000Ph\\u0015(\ufffd\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0004\\u0001\\u0000Ph\\u0015(\ufffd\\u0000\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0004\\u0001\\u0000Ph\\u0015(\\u0000\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022waf_tags\u0022: [\u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0000PH\\u0015(\\u0000 \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0004\\u0001\\u0000Ph\\u0015(\ufffd\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0004\\u0001\\u0000Ph\\u0015(\ufffd\\u0000\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223cb636f460abf39b5e11b10eff77f0f909c8243b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0004\\u0001\\u0000Ph\\u0015(\\u0000\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0000PH\\u0015(\\u0000 \/ HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022Ph(\ufffd\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 28\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 10 % \u2014 via HTTP \u2014 campagne \/24 (151.243.11.0\/24)\u0022, \u0022confidence_pct\u0022: 10, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 28, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 28, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0004\\u0001\\u0000Ph\\u0015(\\u0000\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0000PH\\u0015(\\u0000 \/ HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022Ph(\ufffd\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 10 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +10 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 10, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950734:sap-sapcontrol-path\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.0","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022950734:sap-sapcontrol-path\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":9},{"id":7282280,"ip":"151.243.11.203","ts":"2026-10-23 19:07:41.000000","proto":"tcp","src_port":53574,"dst_port":9000,"service":"http","classification":"slowloris","waf_score":3,"waf_tags":"[\u0022950734:sap-sapcontrol-path\u0022]","http_method":"\u0004\u0001\u0000PCc\u0000","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0004\\u0001\\u0000PCc\\u0000\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 9, \u0022payload_entropy\u0022: 2.94770277922009, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 20.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 28, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002263c5e9405f72f7a8913b1470efb39675273e20ae\u0022, \u0022event_fingerprint\u0022: \u002205f33efe067250442006cc3f5838234fd3bf6a0e\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.1, \u0022classification_confidence\u0022: 0.1, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 28, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022656f2ade018285154084843e184aaa89\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 28}, \u0022payload_preview\u0022: \u0022\\u0004\\u0001\\u0000P\ufffdC\ufffdc\\u0000\u0022, \u0022method\u0022: \u0022\\u0004\\u0001\\u0000PCc\\u0000\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022waf_tags\u0022: [\u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0000PCC\\u0000 \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0004\\u0001\\u0000P\ufffdC\ufffdc\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0004\\u0001\\u0000P\ufffdC\ufffdc\\u0000\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0004\\u0001\\u0000PCc\\u0000\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022waf_tags\u0022: [\u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0000PCC\\u0000 \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0004\\u0001\\u0000P\ufffdC\ufffdc\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0004\\u0001\\u0000P\ufffdC\ufffdc\\u0000\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b3ab5fe27ec03b2c71eb12192c446b38f53d5766\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0004\\u0001\\u0000PCc\\u0000\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0000PCC\\u0000 \/ HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022P\ufffdC\ufffdc\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 28\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 10 % \u2014 via HTTP \u2014 campagne \/24 (151.243.11.0\/24)\u0022, \u0022confidence_pct\u0022: 10, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 28, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 28, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0004\\u0001\\u0000PCc\\u0000\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022\\u0004\\u0001\\u0000PCC\\u0000 \/ HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022P\ufffdC\ufffdc\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 10 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +10 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 10, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950734:sap-sapcontrol-path\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.0","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022950734:sap-sapcontrol-path\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":9},{"id":7282254,"ip":"151.243.11.203","ts":"2026-10-23 19:07:40.000000","proto":"tcp","src_port":53552,"dst_port":9000,"service":"http","classification":"exploit_attempt","waf_score":19,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/c\/fclzlnFJURnC5rDIO1cFgfMo6lQPLRyyzyecMk1VR5Q9uKlehEOfd2PSrUm4VK3fSwKgz65fNeoEWSMEgngyWMb3J4JVpWTS","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 7, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002208bcdb8b5addbb80b0dcf079559495f42e13bcbd\u0022, \u0022http_host_hash\u0022: \u0022f34d9056f07c3b2878de9ec983d821636826a8a5\u0022, \u0022http_target_hash\u0022: \u0022fc7e784b1f253b916a7c13f7cc047a1d71604aca\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 491, \u0022payload_entropy\u0022: 5.673593322957464, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 84.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 49, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022453498e87e825cecea3232558f84c7576c449cac\u0022, \u0022event_fingerprint\u0022: \u0022da4551a512470441d4516c02f0af320e355ef90e\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.72, \u0022classification_confidence\u0022: 0.72, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022a9f3741623f5311a5459a431968528ad\u0022, \u0022payload_hash\u0022: \u0022d8d10bd5ecb361cea21cdb34e28c24e3\u0022, \u0022path_pattern_hash\u0022: \u002255623d3049b3eae4a31d1a1adf0304e7\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 49}, \u0022payload_preview\u0022: \u0022GET \/c\/fclzlnFJURnC5rDIO1cFgfMo6lQPLRyyzyecMk1VR5Q9uKlehEOfd2PSrUm4VK3fSwKgz65fNeoEWSMEgngyWMb3J4JVpWTS HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/c\/fclzlnFJURnC5rDIO1cFgfMo6lQPLRyyzyecMk1VR5Q9uKlehEOfd2PSrUm4VK3fSwKgz65fNeoEWSMEgngyWMb3J4JVpWTS\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/c\/fclzlnFJURnC5rDIO1cFgfMo6lQPLRyyzyecMk1VR5Q9uKlehEOfd2PSrUm4VK3fSwKgz65fNeoEWSMEgngyWMb3J4JVpWTS HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/c\/fclzlnFJURnC5rDIO1cFgfMo6lQPLRyyzyecMk1VR5Q9uKlehEOfd2PSrUm4VK3fSwKgz65fNeoEWSMEgngyWMb3J4JVpWTS HTTP\/1.1\\r\\nhost: youshouldvecomeover.lol\\r\\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 S\u0022, \u0022payload_snippet\u0022: \u0022GET \/c\/fclzlnFJURnC5rDIO1cFgfMo6lQPLRyyzyecMk1VR5Q9uKlehEOfd2PSrUm4VK3fSwKgz65fNeoEWSMEgngyWMb3J4JVpWTS HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/c\/fclzlnFJURnC5rDIO1cFgfMo6lQPLRyyzyecMk1VR5Q9uKlehEOfd2PSrUm4VK3fSwKgz65fNeoEWSMEgngyWMb3J4JVpWTS\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/c\/fclzlnFJURnC5rDIO1cFgfMo6lQPLRyyzyecMk1VR5Q9uKlehEOfd2PSrUm4VK3fSwKgz65fNeoEWSMEgngyWMb3J4JVpWTS HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/c\/fclzlnFJURnC5rDIO1cFgfMo6lQPLRyyzyecMk1VR5Q9uKlehEOfd2PSrUm4VK3fSwKgz65fNeoEWSMEgngyWMb3J4JVpWTS HTTP\/1.1\\r\\nhost: youshouldvecomeover.lol\\r\\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 S\u0022, \u0022payload_snippet\u0022: \u0022GET \/c\/fclzlnFJURnC5rDIO1cFgfMo6lQPLRyyzyecMk1VR5Q9uKlehEOfd2PSrUm4VK3fSwKgz65fNeoEWSMEgngyWMb3J4JVpWTS HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222b01333030c90cfcfe2898e4a0c616f202049c9f\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/c\/fclzlnFJURnC5rDIO1cFgfMo6lQPLRyyzyecMk1VR5Q9uKlehEOfd2PSrUm4VK3fSwKgz65fNeoEWSMEgngyWMb3J4JVpWTS\u0022, \u0022request_line\u0022: \u0022GET \/c\/fclzlnFJURnC5rDIO1cFgfMo6lQPLRyyzyecMk1VR5Q9uKlehEOfd2PSrUm4VK3fSwKgz65fNeoEWSMEgngyWMb3J4JVpWTS HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/c\/fclzlnFJURnC5rDIO1cFgfMo6lQPLRyyzyecMk1VR5Q9uKlehEOfd2PSrUm4VK3fSwKgz65fNeoEWSMEgngyWMb3J4JVpWTS HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/c\/fclzlnFJURnC5rDIO1cFgfMo6lQPLRyyzyecMk1VR5Q9\u2026\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 campagne \/24 (151.243.11.0\/24)\u0022, \u0022confidence_pct\u0022: 72, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 49, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/c\/fclzlnFJURnC5rDIO1cFgfMo6lQPLRyyzyecMk1VR5Q9uKlehEOfd2PSrUm4VK3fSwKgz65fNeoEWSMEgngyWMb3J4JVpWTS\u0022, \u0022request_line\u0022: \u0022GET \/c\/fclzlnFJURnC5rDIO1cFgfMo6lQPLRyyzyecMk1VR5Q9uKlehEOfd2PSrUm4VK3fSwKgz65fNeoEWSMEgngyWMb3J4JVpWTS HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/c\/fclzlnFJURnC5rDIO1cFgfMo6lQPLRyyzyecMk1VR5Q9\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/c\/fclzlnFJURnC5rDIO1cFgfMo6lQPLRyyzyecMk1VR5Q9uKlehEOfd2PSrUm4VK3fSwKgz65fNeoEWSMEgngyWMb3J4JVpWTS HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 72 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 10, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"youshouldvecomeover.lol","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":9,"bytes_in":491},{"id":7282248,"ip":"151.243.11.203","ts":"2026-10-23 19:07:40.000000","proto":"tcp","src_port":53550,"dst_port":9000,"service":"http","classification":"exploit_attempt","waf_score":19,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/c\/wwTnJaI5zyDHMrp4XjxY3o4MeQXx0ZJGeOIE4yFxgjHi67BbLPwV3SsxUVnMp-IzZvcGkW6Oa-s4CzlrwqhN9GCkamF-EAYT","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 7, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002208bcdb8b5addbb80b0dcf079559495f42e13bcbd\u0022, \u0022http_host_hash\u0022: \u0022f34d9056f07c3b2878de9ec983d821636826a8a5\u0022, \u0022http_target_hash\u0022: \u0022c79846487ae844d9187545dcb32865a7517c1129\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 491, \u0022payload_entropy\u0022: 5.709199927348293, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 84.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 49, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022453498e87e825cecea3232558f84c7576c449cac\u0022, \u0022event_fingerprint\u0022: \u0022ae817398612358d7aad595e868f2ada8238efde1\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.72, \u0022classification_confidence\u0022: 0.72, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022a9f3741623f5311a5459a431968528ad\u0022, \u0022payload_hash\u0022: \u0022c4c023966fd52c3741dcb4b4b85d3efd\u0022, \u0022path_pattern_hash\u0022: \u00223f45fa989927ab433efe4ba7fb1ce044\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 49}, \u0022payload_preview\u0022: \u0022GET \/c\/wwTnJaI5zyDHMrp4XjxY3o4MeQXx0ZJGeOIE4yFxgjHi67BbLPwV3SsxUVnMp-IzZvcGkW6Oa-s4CzlrwqhN9GCkamF-EAYT HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/c\/wwTnJaI5zyDHMrp4XjxY3o4MeQXx0ZJGeOIE4yFxgjHi67BbLPwV3SsxUVnMp-IzZvcGkW6Oa-s4CzlrwqhN9GCkamF-EAYT\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/c\/wwTnJaI5zyDHMrp4XjxY3o4MeQXx0ZJGeOIE4yFxgjHi67BbLPwV3SsxUVnMp-IzZvcGkW6Oa-s4CzlrwqhN9GCkamF-EAYT HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/c\/wwTnJaI5zyDHMrp4XjxY3o4MeQXx0ZJGeOIE4yFxgjHi67BbLPwV3SsxUVnMp-IzZvcGkW6Oa-s4CzlrwqhN9GCkamF-EAYT HTTP\/1.1\\r\\nhost: youshouldvecomeover.lol\\r\\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 S\u0022, \u0022payload_snippet\u0022: \u0022GET \/c\/wwTnJaI5zyDHMrp4XjxY3o4MeQXx0ZJGeOIE4yFxgjHi67BbLPwV3SsxUVnMp-IzZvcGkW6Oa-s4CzlrwqhN9GCkamF-EAYT HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/c\/wwTnJaI5zyDHMrp4XjxY3o4MeQXx0ZJGeOIE4yFxgjHi67BbLPwV3SsxUVnMp-IzZvcGkW6Oa-s4CzlrwqhN9GCkamF-EAYT\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/c\/wwTnJaI5zyDHMrp4XjxY3o4MeQXx0ZJGeOIE4yFxgjHi67BbLPwV3SsxUVnMp-IzZvcGkW6Oa-s4CzlrwqhN9GCkamF-EAYT HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/c\/wwTnJaI5zyDHMrp4XjxY3o4MeQXx0ZJGeOIE4yFxgjHi67BbLPwV3SsxUVnMp-IzZvcGkW6Oa-s4CzlrwqhN9GCkamF-EAYT HTTP\/1.1\\r\\nhost: youshouldvecomeover.lol\\r\\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 S\u0022, \u0022payload_snippet\u0022: \u0022GET \/c\/wwTnJaI5zyDHMrp4XjxY3o4MeQXx0ZJGeOIE4yFxgjHi67BbLPwV3SsxUVnMp-IzZvcGkW6Oa-s4CzlrwqhN9GCkamF-EAYT HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b8e229018afff9031fe875e563623def8e3e4ab1\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/c\/wwTnJaI5zyDHMrp4XjxY3o4MeQXx0ZJGeOIE4yFxgjHi67BbLPwV3SsxUVnMp-IzZvcGkW6Oa-s4CzlrwqhN9GCkamF-EAYT\u0022, \u0022request_line\u0022: \u0022GET \/c\/wwTnJaI5zyDHMrp4XjxY3o4MeQXx0ZJGeOIE4yFxgjHi67BbLPwV3SsxUVnMp-IzZvcGkW6Oa-s4CzlrwqhN9GCkamF-EAYT HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/c\/wwTnJaI5zyDHMrp4XjxY3o4MeQXx0ZJGeOIE4yFxgjHi67BbLPwV3SsxUVnMp-IzZvcGkW6Oa-s4CzlrwqhN9GCkamF-EAYT HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/c\/wwTnJaI5zyDHMrp4XjxY3o4MeQXx0ZJGeOIE4yFxgjHi\u2026\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 campagne \/24 (151.243.11.0\/24)\u0022, \u0022confidence_pct\u0022: 72, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 49, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/c\/wwTnJaI5zyDHMrp4XjxY3o4MeQXx0ZJGeOIE4yFxgjHi67BbLPwV3SsxUVnMp-IzZvcGkW6Oa-s4CzlrwqhN9GCkamF-EAYT\u0022, \u0022request_line\u0022: \u0022GET \/c\/wwTnJaI5zyDHMrp4XjxY3o4MeQXx0ZJGeOIE4yFxgjHi67BbLPwV3SsxUVnMp-IzZvcGkW6Oa-s4CzlrwqhN9GCkamF-EAYT HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/c\/wwTnJaI5zyDHMrp4XjxY3o4MeQXx0ZJGeOIE4yFxgjHi\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/c\/wwTnJaI5zyDHMrp4XjxY3o4MeQXx0ZJGeOIE4yFxgjHi67BbLPwV3SsxUVnMp-IzZvcGkW6Oa-s4CzlrwqhN9GCkamF-EAYT HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 72 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 10, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"youshouldvecomeover.lol","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":9,"bytes_in":491},{"id":7282242,"ip":"151.243.11.203","ts":"2026-10-23 19:07:40.000000","proto":"tcp","src_port":53542,"dst_port":9000,"service":"http","classification":"exploit_attempt","waf_score":19,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/c\/Y-z2iFlGCx4ORqLBjDE9tUHEVPI0HLHOcskMCpqeOtdBMlwKS0bA9sEvhVYLRiG2Jla9pXKSz2C8zAeI8IWCW_wTaT5bOzk-","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 7, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002208bcdb8b5addbb80b0dcf079559495f42e13bcbd\u0022, \u0022http_host_hash\u0022: \u0022005c7dc11b2da7269181a8949bfa888f74c4feb2\u0022, \u0022http_target_hash\u0022: \u0022abc1aff9d097f6e847c681200fe8f88d439556b4\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 490, \u0022payload_entropy\u0022: 5.736143345260317, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 84.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 49, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022453498e87e825cecea3232558f84c7576c449cac\u0022, \u0022event_fingerprint\u0022: \u0022245476809617a316a4c01a53047034954ec25edf\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.72, \u0022classification_confidence\u0022: 0.72, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022a9f3741623f5311a5459a431968528ad\u0022, \u0022payload_hash\u0022: \u0022ffabec6ae921b78bb7180521e612c779\u0022, \u0022path_pattern_hash\u0022: \u00226e087e1caf16fd2c184e0b8afab74abf\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 49}, \u0022payload_preview\u0022: \u0022GET \/c\/Y-z2iFlGCx4ORqLBjDE9tUHEVPI0HLHOcskMCpqeOtdBMlwKS0bA9sEvhVYLRiG2Jla9pXKSz2C8zAeI8IWCW_wTaT5bOzk- HTTP\/1.1\\r\\nhost: tooyoung\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/c\/Y-z2iFlGCx4ORqLBjDE9tUHEVPI0HLHOcskMCpqeOtdBMlwKS0bA9sEvhVYLRiG2Jla9pXKSz2C8zAeI8IWCW_wTaT5bOzk-\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/c\/Y-z2iFlGCx4ORqLBjDE9tUHEVPI0HLHOcskMCpqeOtdBMlwKS0bA9sEvhVYLRiG2Jla9pXKSz2C8zAeI8IWCW_wTaT5bOzk- HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/c\/Y-z2iFlGCx4ORqLBjDE9tUHEVPI0HLHOcskMCpqeOtdBMlwKS0bA9sEvhVYLRiG2Jla9pXKSz2C8zAeI8IWCW_wTaT5bOzk- HTTP\/1.1\\r\\nhost: tooyoungtoholdon.world\\r\\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Sa\u0022, \u0022payload_snippet\u0022: \u0022GET \/c\/Y-z2iFlGCx4ORqLBjDE9tUHEVPI0HLHOcskMCpqeOtdBMlwKS0bA9sEvhVYLRiG2Jla9pXKSz2C8zAeI8IWCW_wTaT5bOzk- HTTP\/1.1\\r\\nhost: tooyoung\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/c\/Y-z2iFlGCx4ORqLBjDE9tUHEVPI0HLHOcskMCpqeOtdBMlwKS0bA9sEvhVYLRiG2Jla9pXKSz2C8zAeI8IWCW_wTaT5bOzk-\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/c\/Y-z2iFlGCx4ORqLBjDE9tUHEVPI0HLHOcskMCpqeOtdBMlwKS0bA9sEvhVYLRiG2Jla9pXKSz2C8zAeI8IWCW_wTaT5bOzk- HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/c\/Y-z2iFlGCx4ORqLBjDE9tUHEVPI0HLHOcskMCpqeOtdBMlwKS0bA9sEvhVYLRiG2Jla9pXKSz2C8zAeI8IWCW_wTaT5bOzk- HTTP\/1.1\\r\\nhost: tooyoungtoholdon.world\\r\\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Sa\u0022, \u0022payload_snippet\u0022: \u0022GET \/c\/Y-z2iFlGCx4ORqLBjDE9tUHEVPI0HLHOcskMCpqeOtdBMlwKS0bA9sEvhVYLRiG2Jla9pXKSz2C8zAeI8IWCW_wTaT5bOzk- HTTP\/1.1\\r\\nhost: tooyoung\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e59b6ed995596124ac6466688e1a9621f70496eb\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/c\/Y-z2iFlGCx4ORqLBjDE9tUHEVPI0HLHOcskMCpqeOtdBMlwKS0bA9sEvhVYLRiG2Jla9pXKSz2C8zAeI8IWCW_wTaT5bOzk-\u0022, \u0022request_line\u0022: \u0022GET \/c\/Y-z2iFlGCx4ORqLBjDE9tUHEVPI0HLHOcskMCpqeOtdBMlwKS0bA9sEvhVYLRiG2Jla9pXKSz2C8zAeI8IWCW_wTaT5bOzk- HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/c\/Y-z2iFlGCx4ORqLBjDE9tUHEVPI0HLHOcskMCpqeOtdBMlwKS0bA9sEvhVYLRiG2Jla9pXKSz2C8zAeI8IWCW_wTaT5bOzk- HTTP\/1.1\\r\\nhost: tooyoung\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/c\/Y-z2iFlGCx4ORqLBjDE9tUHEVPI0HLHOcskMCpqeOtdB\u2026\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 campagne \/24 (151.243.11.0\/24)\u0022, \u0022confidence_pct\u0022: 72, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 49, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/c\/Y-z2iFlGCx4ORqLBjDE9tUHEVPI0HLHOcskMCpqeOtdBMlwKS0bA9sEvhVYLRiG2Jla9pXKSz2C8zAeI8IWCW_wTaT5bOzk-\u0022, \u0022request_line\u0022: \u0022GET \/c\/Y-z2iFlGCx4ORqLBjDE9tUHEVPI0HLHOcskMCpqeOtdBMlwKS0bA9sEvhVYLRiG2Jla9pXKSz2C8zAeI8IWCW_wTaT5bOzk- HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/c\/Y-z2iFlGCx4ORqLBjDE9tUHEVPI0HLHOcskMCpqeOtdB\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/c\/Y-z2iFlGCx4ORqLBjDE9tUHEVPI0HLHOcskMCpqeOtdBMlwKS0bA9sEvhVYLRiG2Jla9pXKSz2C8zAeI8IWCW_wTaT5bOzk- HTTP\/1.1\\r\\nhost: tooyoung\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 72 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 10, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022], \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 72}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"tooyoungtoholdon.world","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":9,"bytes_in":490},{"id":7282237,"ip":"151.243.11.203","ts":"2026-10-23 19:07:40.000000","proto":"tcp","src_port":53524,"dst_port":9000,"service":"http","classification":"exploit_attempt","waf_score":19,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/c\/BCZe-N_dwsKnCg9qH2OlHx7hq6y6_8Uz8b3dMEnjWEhHks6bJ0lnXyQJ0ROmWs2wqsek6ihS4Ruf-PLtffasN-peF2KUPehV","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 7, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002208bcdb8b5addbb80b0dcf079559495f42e13bcbd\u0022, \u0022http_host_hash\u0022: \u0022f34d9056f07c3b2878de9ec983d821636826a8a5\u0022, \u0022http_target_hash\u0022: \u0022538dd97b988926a009548992b68b2a11b8f68ced\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 491, \u0022payload_entropy\u0022: 5.693055362589528, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 84.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 49, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022453498e87e825cecea3232558f84c7576c449cac\u0022, \u0022event_fingerprint\u0022: \u0022755fd9c03f891a81c6ab5724653760622111ce1f\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.72, \u0022classification_confidence\u0022: 0.72, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022a9f3741623f5311a5459a431968528ad\u0022, \u0022payload_hash\u0022: \u0022a19b82a6b227ee048c051f2692e41764\u0022, \u0022path_pattern_hash\u0022: \u0022daf315ab17a5ffad8076b21a8fa9e6af\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 49}, \u0022payload_preview\u0022: \u0022GET \/c\/BCZe-N_dwsKnCg9qH2OlHx7hq6y6_8Uz8b3dMEnjWEhHks6bJ0lnXyQJ0ROmWs2wqsek6ihS4Ruf-PLtffasN-peF2KUPehV HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/c\/BCZe-N_dwsKnCg9qH2OlHx7hq6y6_8Uz8b3dMEnjWEhHks6bJ0lnXyQJ0ROmWs2wqsek6ihS4Ruf-PLtffasN-peF2KUPehV\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/c\/BCZe-N_dwsKnCg9qH2OlHx7hq6y6_8Uz8b3dMEnjWEhHks6bJ0lnXyQJ0ROmWs2wqsek6ihS4Ruf-PLtffasN-peF2KUPehV HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/c\/BCZe-N_dwsKnCg9qH2OlHx7hq6y6_8Uz8b3dMEnjWEhHks6bJ0lnXyQJ0ROmWs2wqsek6ihS4Ruf-PLtffasN-peF2KUPehV HTTP\/1.1\\r\\nhost: youshouldvecomeover.lol\\r\\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 S\u0022, \u0022payload_snippet\u0022: \u0022GET \/c\/BCZe-N_dwsKnCg9qH2OlHx7hq6y6_8Uz8b3dMEnjWEhHks6bJ0lnXyQJ0ROmWs2wqsek6ihS4Ruf-PLtffasN-peF2KUPehV HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/c\/BCZe-N_dwsKnCg9qH2OlHx7hq6y6_8Uz8b3dMEnjWEhHks6bJ0lnXyQJ0ROmWs2wqsek6ihS4Ruf-PLtffasN-peF2KUPehV\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/c\/BCZe-N_dwsKnCg9qH2OlHx7hq6y6_8Uz8b3dMEnjWEhHks6bJ0lnXyQJ0ROmWs2wqsek6ihS4Ruf-PLtffasN-peF2KUPehV HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/c\/BCZe-N_dwsKnCg9qH2OlHx7hq6y6_8Uz8b3dMEnjWEhHks6bJ0lnXyQJ0ROmWs2wqsek6ihS4Ruf-PLtffasN-peF2KUPehV HTTP\/1.1\\r\\nhost: youshouldvecomeover.lol\\r\\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 S\u0022, \u0022payload_snippet\u0022: \u0022GET \/c\/BCZe-N_dwsKnCg9qH2OlHx7hq6y6_8Uz8b3dMEnjWEhHks6bJ0lnXyQJ0ROmWs2wqsek6ihS4Ruf-PLtffasN-peF2KUPehV HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228ea52a3578bfb18c81ecceb71457734452376323\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/c\/BCZe-N_dwsKnCg9qH2OlHx7hq6y6_8Uz8b3dMEnjWEhHks6bJ0lnXyQJ0ROmWs2wqsek6ihS4Ruf-PLtffasN-peF2KUPehV\u0022, \u0022request_line\u0022: \u0022GET \/c\/BCZe-N_dwsKnCg9qH2OlHx7hq6y6_8Uz8b3dMEnjWEhHks6bJ0lnXyQJ0ROmWs2wqsek6ihS4Ruf-PLtffasN-peF2KUPehV HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/c\/BCZe-N_dwsKnCg9qH2OlHx7hq6y6_8Uz8b3dMEnjWEhHks6bJ0lnXyQJ0ROmWs2wqsek6ihS4Ruf-PLtffasN-peF2KUPehV HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/c\/BCZe-N_dwsKnCg9qH2OlHx7hq6y6_8Uz8b3dMEnjWEhH\u2026\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 campagne \/24 (151.243.11.0\/24)\u0022, \u0022confidence_pct\u0022: 72, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 49, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/c\/BCZe-N_dwsKnCg9qH2OlHx7hq6y6_8Uz8b3dMEnjWEhHks6bJ0lnXyQJ0ROmWs2wqsek6ihS4Ruf-PLtffasN-peF2KUPehV\u0022, \u0022request_line\u0022: \u0022GET \/c\/BCZe-N_dwsKnCg9qH2OlHx7hq6y6_8Uz8b3dMEnjWEhHks6bJ0lnXyQJ0ROmWs2wqsek6ihS4Ruf-PLtffasN-peF2KUPehV HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/c\/BCZe-N_dwsKnCg9qH2OlHx7hq6y6_8Uz8b3dMEnjWEhH\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/c\/BCZe-N_dwsKnCg9qH2OlHx7hq6y6_8Uz8b3dMEnjWEhHks6bJ0lnXyQJ0ROmWs2wqsek6ihS4Ruf-PLtffasN-peF2KUPehV HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 72 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 10, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"youshouldvecomeover.lol","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":9,"bytes_in":491},{"id":7282224,"ip":"151.243.11.203","ts":"2026-10-23 19:07:40.000000","proto":"tcp","src_port":53514,"dst_port":9000,"service":"http","classification":"exploit_attempt","waf_score":19,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/c\/Woron98b5WtNPca5NBOKUY_evBFgQ_qFGU6elGKxJr3mi1Ids60i7qFGegr9TmR4WN3BJDJiSRfr043mD3I-sxlv6SaAsxj0","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 7, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002208bcdb8b5addbb80b0dcf079559495f42e13bcbd\u0022, \u0022http_host_hash\u0022: \u0022f34d9056f07c3b2878de9ec983d821636826a8a5\u0022, \u0022http_target_hash\u0022: \u00223a5c19d08fbf30f0eedf270c5c0456950b319a90\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 491, \u0022payload_entropy\u0022: 5.652797476021334, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 84.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 49, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022453498e87e825cecea3232558f84c7576c449cac\u0022, \u0022event_fingerprint\u0022: \u0022daecb87bb420a1f66d0d4acf6ac689360552b991\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.72, \u0022classification_confidence\u0022: 0.72, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022a9f3741623f5311a5459a431968528ad\u0022, \u0022payload_hash\u0022: \u00229d11b83cb1ec7622b7443f7a0f0542bd\u0022, \u0022path_pattern_hash\u0022: \u00227fa39d2e7c3642b7255c2351d4a96a6f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 49}, \u0022payload_preview\u0022: \u0022GET \/c\/Woron98b5WtNPca5NBOKUY_evBFgQ_qFGU6elGKxJr3mi1Ids60i7qFGegr9TmR4WN3BJDJiSRfr043mD3I-sxlv6SaAsxj0 HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/c\/Woron98b5WtNPca5NBOKUY_evBFgQ_qFGU6elGKxJr3mi1Ids60i7qFGegr9TmR4WN3BJDJiSRfr043mD3I-sxlv6SaAsxj0\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/c\/Woron98b5WtNPca5NBOKUY_evBFgQ_qFGU6elGKxJr3mi1Ids60i7qFGegr9TmR4WN3BJDJiSRfr043mD3I-sxlv6SaAsxj0 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/c\/Woron98b5WtNPca5NBOKUY_evBFgQ_qFGU6elGKxJr3mi1Ids60i7qFGegr9TmR4WN3BJDJiSRfr043mD3I-sxlv6SaAsxj0 HTTP\/1.1\\r\\nhost: youshouldvecomeover.lol\\r\\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 S\u0022, \u0022payload_snippet\u0022: \u0022GET \/c\/Woron98b5WtNPca5NBOKUY_evBFgQ_qFGU6elGKxJr3mi1Ids60i7qFGegr9TmR4WN3BJDJiSRfr043mD3I-sxlv6SaAsxj0 HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/c\/Woron98b5WtNPca5NBOKUY_evBFgQ_qFGU6elGKxJr3mi1Ids60i7qFGegr9TmR4WN3BJDJiSRfr043mD3I-sxlv6SaAsxj0\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/c\/Woron98b5WtNPca5NBOKUY_evBFgQ_qFGU6elGKxJr3mi1Ids60i7qFGegr9TmR4WN3BJDJiSRfr043mD3I-sxlv6SaAsxj0 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/c\/Woron98b5WtNPca5NBOKUY_evBFgQ_qFGU6elGKxJr3mi1Ids60i7qFGegr9TmR4WN3BJDJiSRfr043mD3I-sxlv6SaAsxj0 HTTP\/1.1\\r\\nhost: youshouldvecomeover.lol\\r\\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 S\u0022, \u0022payload_snippet\u0022: \u0022GET \/c\/Woron98b5WtNPca5NBOKUY_evBFgQ_qFGU6elGKxJr3mi1Ids60i7qFGegr9TmR4WN3BJDJiSRfr043mD3I-sxlv6SaAsxj0 HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022da2632daba3f5c2a5fba418cd0756c4c9661ea5d\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/c\/Woron98b5WtNPca5NBOKUY_evBFgQ_qFGU6elGKxJr3mi1Ids60i7qFGegr9TmR4WN3BJDJiSRfr043mD3I-sxlv6SaAsxj0\u0022, \u0022request_line\u0022: \u0022GET \/c\/Woron98b5WtNPca5NBOKUY_evBFgQ_qFGU6elGKxJr3mi1Ids60i7qFGegr9TmR4WN3BJDJiSRfr043mD3I-sxlv6SaAsxj0 HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/c\/Woron98b5WtNPca5NBOKUY_evBFgQ_qFGU6elGKxJr3mi1Ids60i7qFGegr9TmR4WN3BJDJiSRfr043mD3I-sxlv6SaAsxj0 HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/c\/Woron98b5WtNPca5NBOKUY_evBFgQ_qFGU6elGKxJr3m\u2026\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 campagne \/24 (151.243.11.0\/24)\u0022, \u0022confidence_pct\u0022: 72, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 49, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/c\/Woron98b5WtNPca5NBOKUY_evBFgQ_qFGU6elGKxJr3mi1Ids60i7qFGegr9TmR4WN3BJDJiSRfr043mD3I-sxlv6SaAsxj0\u0022, \u0022request_line\u0022: \u0022GET \/c\/Woron98b5WtNPca5NBOKUY_evBFgQ_qFGU6elGKxJr3mi1Ids60i7qFGegr9TmR4WN3BJDJiSRfr043mD3I-sxlv6SaAsxj0 HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/c\/Woron98b5WtNPca5NBOKUY_evBFgQ_qFGU6elGKxJr3m\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/c\/Woron98b5WtNPca5NBOKUY_evBFgQ_qFGU6elGKxJr3mi1Ids60i7qFGegr9TmR4WN3BJDJiSRfr043mD3I-sxlv6SaAsxj0 HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 72 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 10, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"youshouldvecomeover.lol","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":9,"bytes_in":491},{"id":7282220,"ip":"151.243.11.203","ts":"2026-10-23 19:07:40.000000","proto":"tcp","src_port":53484,"dst_port":9000,"service":"http","classification":"exploit_attempt","waf_score":19,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/c\/tt4xZyl61wE_zpnYTsYacW1P6ZIZOLTTWVX7gm_WqmXl6tS3e9HmU8A-116yeGkcyCgxvRJDvhIFEPGdv6kv6RRoGc_xJWXZ","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204d696e494f0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a436f6e74656e742d4c656e6774683a203139300d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e3c4c6973\u0022, \u0022emulator_response_len\u0022: 276, \u0022http_header_count\u0022: 7, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002208bcdb8b5addbb80b0dcf079559495f42e13bcbd\u0022, \u0022http_host_hash\u0022: \u0022f34d9056f07c3b2878de9ec983d821636826a8a5\u0022, \u0022http_target_hash\u0022: \u002273b4df4e7a036b3677ce3c09b14f7b9c6551ae4c\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 491, \u0022payload_entropy\u0022: 5.682048660909428, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 84.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 49, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022453498e87e825cecea3232558f84c7576c449cac\u0022, \u0022event_fingerprint\u0022: \u0022bf105e26e6e4736fcdc80ec2f89d56cbcdf6a3db\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.72, \u0022classification_confidence\u0022: 0.72, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022a9f3741623f5311a5459a431968528ad\u0022, \u0022payload_hash\u0022: \u00222fda3b000031de5d459791f01e682208\u0022, \u0022path_pattern_hash\u0022: \u0022408b5c614aaf47d1eee901a92ce5c71f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 49}, \u0022payload_preview\u0022: \u0022GET \/c\/tt4xZyl61wE_zpnYTsYacW1P6ZIZOLTTWVX7gm_WqmXl6tS3e9HmU8A-116yeGkcyCgxvRJDvhIFEPGdv6kv6RRoGc_xJWXZ HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/c\/tt4xZyl61wE_zpnYTsYacW1P6ZIZOLTTWVX7gm_WqmXl6tS3e9HmU8A-116yeGkcyCgxvRJDvhIFEPGdv6kv6RRoGc_xJWXZ\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/c\/tt4xZyl61wE_zpnYTsYacW1P6ZIZOLTTWVX7gm_WqmXl6tS3e9HmU8A-116yeGkcyCgxvRJDvhIFEPGdv6kv6RRoGc_xJWXZ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/c\/tt4xZyl61wE_zpnYTsYacW1P6ZIZOLTTWVX7gm_WqmXl6tS3e9HmU8A-116yeGkcyCgxvRJDvhIFEPGdv6kv6RRoGc_xJWXZ HTTP\/1.1\\r\\nhost: youshouldvecomeover.lol\\r\\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 S\u0022, \u0022payload_snippet\u0022: \u0022GET \/c\/tt4xZyl61wE_zpnYTsYacW1P6ZIZOLTTWVX7gm_WqmXl6tS3e9HmU8A-116yeGkcyCgxvRJDvhIFEPGdv6kv6RRoGc_xJWXZ HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/c\/tt4xZyl61wE_zpnYTsYacW1P6ZIZOLTTWVX7gm_WqmXl6tS3e9HmU8A-116yeGkcyCgxvRJDvhIFEPGdv6kv6RRoGc_xJWXZ\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/c\/tt4xZyl61wE_zpnYTsYacW1P6ZIZOLTTWVX7gm_WqmXl6tS3e9HmU8A-116yeGkcyCgxvRJDvhIFEPGdv6kv6RRoGc_xJWXZ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/c\/tt4xZyl61wE_zpnYTsYacW1P6ZIZOLTTWVX7gm_WqmXl6tS3e9HmU8A-116yeGkcyCgxvRJDvhIFEPGdv6kv6RRoGc_xJWXZ HTTP\/1.1\\r\\nhost: youshouldvecomeover.lol\\r\\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 S\u0022, \u0022payload_snippet\u0022: \u0022GET \/c\/tt4xZyl61wE_zpnYTsYacW1P6ZIZOLTTWVX7gm_WqmXl6tS3e9HmU8A-116yeGkcyCgxvRJDvhIFEPGdv6kv6RRoGc_xJWXZ HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222a791deafeb7e418619045aebe3c47ac214a85e0\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/c\/tt4xZyl61wE_zpnYTsYacW1P6ZIZOLTTWVX7gm_WqmXl6tS3e9HmU8A-116yeGkcyCgxvRJDvhIFEPGdv6kv6RRoGc_xJWXZ\u0022, \u0022request_line\u0022: \u0022GET \/c\/tt4xZyl61wE_zpnYTsYacW1P6ZIZOLTTWVX7gm_WqmXl6tS3e9HmU8A-116yeGkcyCgxvRJDvhIFEPGdv6kv6RRoGc_xJWXZ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/c\/tt4xZyl61wE_zpnYTsYacW1P6ZIZOLTTWVX7gm_WqmXl6tS3e9HmU8A-116yeGkcyCgxvRJDvhIFEPGdv6kv6RRoGc_xJWXZ HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/c\/tt4xZyl61wE_zpnYTsYacW1P6ZIZOLTTWVX7gm_WqmXl\u2026\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 campagne \/24 (151.243.11.0\/24)\u0022, \u0022confidence_pct\u0022: 72, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 49, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/c\/tt4xZyl61wE_zpnYTsYacW1P6ZIZOLTTWVX7gm_WqmXl6tS3e9HmU8A-116yeGkcyCgxvRJDvhIFEPGdv6kv6RRoGc_xJWXZ\u0022, \u0022request_line\u0022: \u0022GET \/c\/tt4xZyl61wE_zpnYTsYacW1P6ZIZOLTTWVX7gm_WqmXl6tS3e9HmU8A-116yeGkcyCgxvRJDvhIFEPGdv6kv6RRoGc_xJWXZ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/c\/tt4xZyl61wE_zpnYTsYacW1P6ZIZOLTTWVX7gm_WqmXl\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/c\/tt4xZyl61wE_zpnYTsYacW1P6ZIZOLTTWVX7gm_WqmXl6tS3e9HmU8A-116yeGkcyCgxvRJDvhIFEPGdv6kv6RRoGc_xJWXZ HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 72 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 10, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"youshouldvecomeover.lol","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":9,"bytes_in":491},{"id":7282213,"ip":"151.243.11.203","ts":"2026-10-23 19:07:40.000000","proto":"tcp","src_port":53478,"dst_port":9000,"service":"http","classification":"exploit_attempt","waf_score":19,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/c\/45p99VD7DMBv0HoUoEr6OBszEbIA9ai9-1cdbvEAxfMg53dx4MPUrL4dC7pfAomfHPzfHDZuTgkSED_yQZs7jMxIw8l8hLB-","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 7, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002208bcdb8b5addbb80b0dcf079559495f42e13bcbd\u0022, \u0022http_host_hash\u0022: \u0022005c7dc11b2da7269181a8949bfa888f74c4feb2\u0022, \u0022http_target_hash\u0022: \u00223a8c6f1d942a418dbec097316301b688c9c83eeb\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 490, \u0022payload_entropy\u0022: 5.703893890633949, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 84.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 49, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022453498e87e825cecea3232558f84c7576c449cac\u0022, \u0022event_fingerprint\u0022: \u0022e170c2e19d00541928358c6a7f3437497d298a2d\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.72, \u0022classification_confidence\u0022: 0.72, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022a9f3741623f5311a5459a431968528ad\u0022, \u0022payload_hash\u0022: \u0022a21784c34ea8b407d8920c4bc631a218\u0022, \u0022path_pattern_hash\u0022: \u0022a88a19ae127fb97b452421ccbce69f6e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 49}, \u0022payload_preview\u0022: \u0022GET \/c\/45p99VD7DMBv0HoUoEr6OBszEbIA9ai9-1cdbvEAxfMg53dx4MPUrL4dC7pfAomfHPzfHDZuTgkSED_yQZs7jMxIw8l8hLB- HTTP\/1.1\\r\\nhost: tooyoung\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/c\/45p99VD7DMBv0HoUoEr6OBszEbIA9ai9-1cdbvEAxfMg53dx4MPUrL4dC7pfAomfHPzfHDZuTgkSED_yQZs7jMxIw8l8hLB-\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/c\/45p99VD7DMBv0HoUoEr6OBszEbIA9ai9-1cdbvEAxfMg53dx4MPUrL4dC7pfAomfHPzfHDZuTgkSED_yQZs7jMxIw8l8hLB- HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/c\/45p99VD7DMBv0HoUoEr6OBszEbIA9ai9-1cdbvEAxfMg53dx4MPUrL4dC7pfAomfHPzfHDZuTgkSED_yQZs7jMxIw8l8hLB- HTTP\/1.1\\r\\nhost: tooyoungtoholdon.world\\r\\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Sa\u0022, \u0022payload_snippet\u0022: \u0022GET \/c\/45p99VD7DMBv0HoUoEr6OBszEbIA9ai9-1cdbvEAxfMg53dx4MPUrL4dC7pfAomfHPzfHDZuTgkSED_yQZs7jMxIw8l8hLB- HTTP\/1.1\\r\\nhost: tooyoung\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/c\/45p99VD7DMBv0HoUoEr6OBszEbIA9ai9-1cdbvEAxfMg53dx4MPUrL4dC7pfAomfHPzfHDZuTgkSED_yQZs7jMxIw8l8hLB-\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/c\/45p99VD7DMBv0HoUoEr6OBszEbIA9ai9-1cdbvEAxfMg53dx4MPUrL4dC7pfAomfHPzfHDZuTgkSED_yQZs7jMxIw8l8hLB- HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/c\/45p99VD7DMBv0HoUoEr6OBszEbIA9ai9-1cdbvEAxfMg53dx4MPUrL4dC7pfAomfHPzfHDZuTgkSED_yQZs7jMxIw8l8hLB- HTTP\/1.1\\r\\nhost: tooyoungtoholdon.world\\r\\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Sa\u0022, \u0022payload_snippet\u0022: \u0022GET \/c\/45p99VD7DMBv0HoUoEr6OBszEbIA9ai9-1cdbvEAxfMg53dx4MPUrL4dC7pfAomfHPzfHDZuTgkSED_yQZs7jMxIw8l8hLB- HTTP\/1.1\\r\\nhost: tooyoung\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022649536c841048f839a8df2aacc00980dc40c2275\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/c\/45p99VD7DMBv0HoUoEr6OBszEbIA9ai9-1cdbvEAxfMg53dx4MPUrL4dC7pfAomfHPzfHDZuTgkSED_yQZs7jMxIw8l8hLB-\u0022, \u0022request_line\u0022: \u0022GET \/c\/45p99VD7DMBv0HoUoEr6OBszEbIA9ai9-1cdbvEAxfMg53dx4MPUrL4dC7pfAomfHPzfHDZuTgkSED_yQZs7jMxIw8l8hLB- HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/c\/45p99VD7DMBv0HoUoEr6OBszEbIA9ai9-1cdbvEAxfMg53dx4MPUrL4dC7pfAomfHPzfHDZuTgkSED_yQZs7jMxIw8l8hLB- HTTP\/1.1\\r\\nhost: tooyoung\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/c\/45p99VD7DMBv0HoUoEr6OBszEbIA9ai9-1cdbvEAxfMg\u2026\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 campagne \/24 (151.243.11.0\/24)\u0022, \u0022confidence_pct\u0022: 72, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 49, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/c\/45p99VD7DMBv0HoUoEr6OBszEbIA9ai9-1cdbvEAxfMg53dx4MPUrL4dC7pfAomfHPzfHDZuTgkSED_yQZs7jMxIw8l8hLB-\u0022, \u0022request_line\u0022: \u0022GET \/c\/45p99VD7DMBv0HoUoEr6OBszEbIA9ai9-1cdbvEAxfMg53dx4MPUrL4dC7pfAomfHPzfHDZuTgkSED_yQZs7jMxIw8l8hLB- HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/c\/45p99VD7DMBv0HoUoEr6OBszEbIA9ai9-1cdbvEAxfMg\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/c\/45p99VD7DMBv0HoUoEr6OBszEbIA9ai9-1cdbvEAxfMg53dx4MPUrL4dC7pfAomfHPzfHDZuTgkSED_yQZs7jMxIw8l8hLB- HTTP\/1.1\\r\\nhost: tooyoung\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 72 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"tooyoungtoholdon.world","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":9,"bytes_in":490},{"id":7282199,"ip":"151.243.11.203","ts":"2026-10-23 19:07:40.000000","proto":"tcp","src_port":53456,"dst_port":9000,"service":"http","classification":"exploit_attempt","waf_score":19,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/c\/Awa2CKBzdNwE3nFWMd7QqBMqlNduwJ7oZ_MuNut_A6E_Xwg1mtnLzQXznqYNQUZZrsO3EZb8o5xnXQf1fe3_IRoBXWCr0abw","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 7, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002208bcdb8b5addbb80b0dcf079559495f42e13bcbd\u0022, \u0022http_host_hash\u0022: \u0022f34d9056f07c3b2878de9ec983d821636826a8a5\u0022, \u0022http_target_hash\u0022: \u00223a82c963892253a8ce79d85f6122dcd8ee2f9f8b\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 491, \u0022payload_entropy\u0022: 5.710548200501915, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 84.0, \u0022risk_classification\u0022: 72.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 49, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022453498e87e825cecea3232558f84c7576c449cac\u0022, \u0022event_fingerprint\u0022: \u00228aaf67e6ea0e603969e13a129df58654de346cc0\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022confidence\u0022: 0.72, \u0022classification_confidence\u0022: 0.72, \u0022precision_score\u0022: 73, \u0022precision_signals\u0022: [\u0022MITRE-T1190\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1190\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 62.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022a9f3741623f5311a5459a431968528ad\u0022, \u0022payload_hash\u0022: \u0022d5587d7a7be5cc109db75c32f52c344e\u0022, \u0022path_pattern_hash\u0022: \u0022ff2f8f622583a83fb1174397ad2d6a22\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 49}, \u0022payload_preview\u0022: \u0022GET \/c\/Awa2CKBzdNwE3nFWMd7QqBMqlNduwJ7oZ_MuNut_A6E_Xwg1mtnLzQXznqYNQUZZrsO3EZb8o5xnXQf1fe3_IRoBXWCr0abw HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/c\/Awa2CKBzdNwE3nFWMd7QqBMqlNduwJ7oZ_MuNut_A6E_Xwg1mtnLzQXznqYNQUZZrsO3EZb8o5xnXQf1fe3_IRoBXWCr0abw\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/c\/Awa2CKBzdNwE3nFWMd7QqBMqlNduwJ7oZ_MuNut_A6E_Xwg1mtnLzQXznqYNQUZZrsO3EZb8o5xnXQf1fe3_IRoBXWCr0abw HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/c\/Awa2CKBzdNwE3nFWMd7QqBMqlNduwJ7oZ_MuNut_A6E_Xwg1mtnLzQXznqYNQUZZrsO3EZb8o5xnXQf1fe3_IRoBXWCr0abw HTTP\/1.1\\r\\nhost: youshouldvecomeover.lol\\r\\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 S\u0022, \u0022payload_snippet\u0022: \u0022GET \/c\/Awa2CKBzdNwE3nFWMd7QqBMqlNduwJ7oZ_MuNut_A6E_Xwg1mtnLzQXznqYNQUZZrsO3EZb8o5xnXQf1fe3_IRoBXWCr0abw HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/c\/Awa2CKBzdNwE3nFWMd7QqBMqlNduwJ7oZ_MuNut_A6E_Xwg1mtnLzQXznqYNQUZZrsO3EZb8o5xnXQf1fe3_IRoBXWCr0abw\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/c\/Awa2CKBzdNwE3nFWMd7QqBMqlNduwJ7oZ_MuNut_A6E_Xwg1mtnLzQXznqYNQUZZrsO3EZb8o5xnXQf1fe3_IRoBXWCr0abw HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/c\/Awa2CKBzdNwE3nFWMd7QqBMqlNduwJ7oZ_MuNut_A6E_Xwg1mtnLzQXznqYNQUZZrsO3EZb8o5xnXQf1fe3_IRoBXWCr0abw HTTP\/1.1\\r\\nhost: youshouldvecomeover.lol\\r\\nuser-agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 S\u0022, \u0022payload_snippet\u0022: \u0022GET \/c\/Awa2CKBzdNwE3nFWMd7QqBMqlNduwJ7oZ_MuNut_A6E_Xwg1mtnLzQXznqYNQUZZrsO3EZb8o5xnXQf1fe3_IRoBXWCr0abw HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224cc98bff0c26f727353288e3f221e8fb1f68700f\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/c\/Awa2CKBzdNwE3nFWMd7QqBMqlNduwJ7oZ_MuNut_A6E_Xwg1mtnLzQXznqYNQUZZrsO3EZb8o5xnXQf1fe3_IRoBXWCr0abw\u0022, \u0022request_line\u0022: \u0022GET \/c\/Awa2CKBzdNwE3nFWMd7QqBMqlNduwJ7oZ_MuNut_A6E_Xwg1mtnLzQXznqYNQUZZrsO3EZb8o5xnXQf1fe3_IRoBXWCr0abw HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/c\/Awa2CKBzdNwE3nFWMd7QqBMqlNduwJ7oZ_MuNut_A6E_Xwg1mtnLzQXznqYNQUZZrsO3EZb8o5xnXQf1fe3_IRoBXWCr0abw HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/c\/Awa2CKBzdNwE3nFWMd7QqBMqlNduwJ7oZ_MuNut_A6E_\u2026\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tentative d\u0027exploit (tag rce-0) \u00b7 confiance 62%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 72 % \u2014 via HTTP \u2014 campagne \/24 (151.243.11.0\/24)\u0022, \u0022confidence_pct\u0022: 72, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 72.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 49, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1190\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1190\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/c\/Awa2CKBzdNwE3nFWMd7QqBMqlNduwJ7oZ_MuNut_A6E_Xwg1mtnLzQXznqYNQUZZrsO3EZb8o5xnXQf1fe3_IRoBXWCr0abw\u0022, \u0022request_line\u0022: \u0022GET \/c\/Awa2CKBzdNwE3nFWMd7QqBMqlNduwJ7oZ_MuNut_A6E_Xwg1mtnLzQXznqYNQUZZrsO3EZb8o5xnXQf1fe3_IRoBXWCr0abw HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022exploit attempt \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/c\/Awa2CKBzdNwE3nFWMd7QqBMqlNduwJ7oZ_MuNut_A6E_\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/c\/Awa2CKBzdNwE3nFWMd7QqBMqlNduwJ7oZ_MuNut_A6E_Xwg1mtnLzQXznqYNQUZZrsO3EZb8o5xnXQf1fe3_IRoBXWCr0abw HTTP\/1.1\\r\\nhost: youshoul\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 62 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 72 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +10 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 9, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022], \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 96}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"youshouldvecomeover.lol","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.0.0 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":9,"bytes_in":491},{"id":7254158,"ip":"151.243.11.203","ts":"2026-10-23 17:50:26.000000","proto":"tcp","src_port":48838,"dst_port":9000,"service":"http","classification":"slowloris","waf_score":3,"waf_tags":"[\u0022950734:sap-sapcontrol-path\u0022]","http_method":"\u0004\u0001\u00013\u078c2\u0000","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0004\\u0001\\u00013\u078c2\\u0000\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 9, \u0022payload_entropy\u0022: 2.94770277922009, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 20.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 28, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002263c5e9405f72f7a8913b1470efb39675273e20ae\u0022, \u0022event_fingerprint\u0022: \u002205f33efe067250442006cc3f5838234fd3bf6a0e\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.1, \u0022classification_confidence\u0022: 0.1, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 28, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022fa7aa61033535afa526dd888eb4db7dc\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 28}, \u0022payload_preview\u0022: \u0022\\u0004\\u0001\\u0001\ufffd3\u078c2\\u0000\u0022, \u0022method\u0022: \u0022\\u0004\\u0001\\u00013\u078c2\\u0000\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022waf_tags\u0022: [\u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022\\u0004\\u0001\\u00013\u078c2\\u0000 \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0004\\u0001\\u0001\ufffd3\u078c2\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0004\\u0001\\u0001\ufffd3\u078c2\\u0000\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0004\\u0001\\u00013\u078c2\\u0000\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022waf_tags\u0022: [\u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022\\u0004\\u0001\\u00013\u078c2\\u0000 \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0004\\u0001\\u0001\ufffd3\u078c2\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0004\\u0001\\u0001\ufffd3\u078c2\\u0000\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d8dc7edf7bbb5480f75d4d93c20eb07cb04d80d3\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0004\\u0001\\u00013\u078c2\\u0000\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022\\u0004\\u0001\\u00013\u078c2\\u0000 \/ HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd3\u078c2\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 28\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 10 % \u2014 via HTTP \u2014 campagne \/24 (151.243.11.0\/24)\u0022, \u0022confidence_pct\u0022: 10, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 28, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 28, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0004\\u0001\\u00013\u078c2\\u0000\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022\\u0004\\u0001\\u00013\u078c2\\u0000 \/ HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd3\u078c2\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 10 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +10 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950734:sap-sapcontrol-path\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.0","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022950734:sap-sapcontrol-path\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":9},{"id":7254147,"ip":"151.243.11.203","ts":"2026-10-23 17:50:26.000000","proto":"tcp","src_port":48832,"dst_port":9000,"service":"http","classification":"web_probe","waf_score":0,"waf_tags":"[]","http_method":"CONNECT","http_target":"104.21.40.244:80","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 2, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022244:80\u0022, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: \u0022bf22a149005b93fe196a61387488f4add7205582\u0022, \u0022http_target_hash\u0022: \u0022bf22a149005b93fe196a61387488f4add7205582\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 91, \u0022payload_entropy\u0022: 4.761248519654219, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 40, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b80a574c77118c7197f63cb73fb4d19a4aa43718\u0022, \u0022event_fingerprint\u0022: \u002257473e3fb0478297d0fdc31f42ea33d7399bf739\u0022, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022a9b5438c59e3c0fe98103592c829a477\u0022, \u0022path_pattern_hash\u0022: \u0022e9366d67f9063c85310b3b510c9d1828\u0022}, \u0022service_name\u0022: \u0022http\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 40}, \u0022payload_preview\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\\r\\nHost: 104.21.40.244:80\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022CONNECT\u0022, \u0022path\u0022: \u0022104.21.40.244:80\u0022, \u0022request_line\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\\r\\nHost: 104.21.40.244:80\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\\r\\nHost: 104.21.40.244:80\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022CONNECT\u0022, \u0022path\u0022: \u0022104.21.40.244:80\u0022, \u0022request_line\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\\r\\nHost: 104.21.40.244:80\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\\r\\nHost: 104.21.40.244:80\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022}, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022confidence\u0022: 0.87, \u0022classification_confidence\u0022: 0.87, \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002202a20f3dea02f2bac567efd19e50aa709142ea13\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_path\u0022: \u0022104.21.40.244:80\u0022, \u0022request_line\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\\r\\nHost: 104.21.40.244:80\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.21.40.244:80\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 77 % \u2014 Score WAF 8\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 40\/100\u0022, \u0022confidence_pct\u0022: 87, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 40, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_path\u0022: \u0022104.21.40.244:80\u0022, \u0022request_line\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.21.40.244:80\u0022, \u0022evidence_snippet\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\\r\\nHost: 104.21.40.244:80\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 77 % \u2014 Score WAF 8\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 87 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_dangerous_method\u0022, \u0022http_method_uncommon\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"104.21.40.244:80","http_user_agent":null,"http_referer":null,"tags":"[\u0022http_dangerous_method\u0022, \u0022http_method_uncommon\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":91},{"id":7254130,"ip":"151.243.11.203","ts":"2026-10-23 17:50:26.000000","proto":"tcp","src_port":48776,"dst_port":9000,"service":"http","classification":"slowloris","waf_score":3,"waf_tags":"[\u0022950734:sap-sapcontrol-path\u0022]","http_method":"\u0004\u0001\u00013(\u0000","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 0, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: null, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022\\u0004\\u0001\\u00013(\\u0000\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 9, \u0022payload_entropy\u0022: 2.94770277922009, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 20.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 28, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002263c5e9405f72f7a8913b1470efb39675273e20ae\u0022, \u0022event_fingerprint\u0022: \u002205f33efe067250442006cc3f5838234fd3bf6a0e\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.1, \u0022classification_confidence\u0022: 0.1, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 28, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022ea9fdabe5c0655ede7326703b196bd27\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 28}, \u0022payload_preview\u0022: \u0022\\u0004\\u0001\\u0001\ufffd3\ufffd(\ufffd\\u0000\u0022, \u0022method\u0022: \u0022\\u0004\\u0001\\u00013(\\u0000\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022waf_tags\u0022: [\u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022\\u0004\\u0001\\u00013(\\u0000 \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0004\\u0001\\u0001\ufffd3\ufffd(\ufffd\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0004\\u0001\\u0001\ufffd3\ufffd(\ufffd\\u0000\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022\\u0004\\u0001\\u00013(\\u0000\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022waf_tags\u0022: [\u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022\\u0004\\u0001\\u00013(\\u0000 \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022\\u0004\\u0001\\u0001\ufffd3\ufffd(\ufffd\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0004\\u0001\\u0001\ufffd3\ufffd(\ufffd\\u0000\u0022, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222ca5c66082b9c3ddbcfa7c974b1497d9f27c8ba5\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0004\\u0001\\u00013(\\u0000\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022\\u0004\\u0001\\u00013(\\u0000 \/ HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd3\ufffd(\ufffd\u0022, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Tags WAF: sap-sapcontrol-path \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 28\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 10 % \u2014 via HTTP \u2014 campagne \/24 (151.243.11.0\/24)\u0022, \u0022confidence_pct\u0022: 10, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 20.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 28, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 28, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022\\u0004\\u0001\\u00013(\\u0000\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022\\u0004\\u0001\\u00013(\\u0000 \/ HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022slowloris \u00b7 via HTTP:9000 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd3\ufffd(\ufffd\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 1 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 10 % \u2014 Score WAF 20 \u00b7 Bonus corr\u00e9lation +10 \u00b7 1 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950734:sap-sapcontrol-path\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.0","http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022950734:sap-sapcontrol-path\u0022, \u0022http_no_ua\u0022, \u0022net_slowloris\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":9},{"id":7254122,"ip":"151.243.11.203","ts":"2026-10-23 17:50:26.000000","proto":"tcp","src_port":48770,"dst_port":9000,"service":"http","classification":"web_probe","waf_score":0,"waf_tags":"[]","http_method":"CONNECT","http_target":"172.67.140.99:80","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 2, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u002299:80\u0022, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: \u0022456682a5443865e7f6a7caecd7e34a9637eb58a0\u0022, \u0022http_target_hash\u0022: \u0022456682a5443865e7f6a7caecd7e34a9637eb58a0\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 91, \u0022payload_entropy\u0022: 4.953663629591878, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 40, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b80a574c77118c7197f63cb73fb4d19a4aa43718\u0022, \u0022event_fingerprint\u0022: \u0022b7b03067ef14c2778b4400825fdae07e12f87c91\u0022, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002201b58411789319eb21c15c7c3cd4c663\u0022, \u0022path_pattern_hash\u0022: \u0022e57a21a07469698c076730997067e5cc\u0022}, \u0022service_name\u0022: \u0022http\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 40}, \u0022payload_preview\u0022: \u0022CONNECT 172.67.140.99:80 HTTP\/1.1\\r\\nHost: 172.67.140.99:80\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022CONNECT\u0022, \u0022path\u0022: \u0022172.67.140.99:80\u0022, \u0022request_line\u0022: \u0022CONNECT 172.67.140.99:80 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022CONNECT 172.67.140.99:80 HTTP\/1.1\\r\\nHost: 172.67.140.99:80\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022CONNECT 172.67.140.99:80 HTTP\/1.1\\r\\nHost: 172.67.140.99:80\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022CONNECT\u0022, \u0022path\u0022: \u0022172.67.140.99:80\u0022, \u0022request_line\u0022: \u0022CONNECT 172.67.140.99:80 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022CONNECT 172.67.140.99:80 HTTP\/1.1\\r\\nHost: 172.67.140.99:80\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022CONNECT 172.67.140.99:80 HTTP\/1.1\\r\\nHost: 172.67.140.99:80\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022}, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022confidence\u0022: 0.87, \u0022classification_confidence\u0022: 0.87, \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a55e17707c1af48b8f4000b6539c55dc6f36c4cf\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_path\u0022: \u0022172.67.140.99:80\u0022, \u0022request_line\u0022: \u0022CONNECT 172.67.140.99:80 HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022CONNECT 172.67.140.99:80 HTTP\/1.1\\r\\nHost: 172.67.140.99:80\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe) \u00b7 \u2192 172.67.140.99:80\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 77 % \u2014 Score WAF 8\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 40\/100\u0022, \u0022confidence_pct\u0022: 87, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 40, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_path\u0022: \u0022172.67.140.99:80\u0022, \u0022request_line\u0022: \u0022CONNECT 172.67.140.99:80 HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe) \u00b7 \u2192 172.67.140.99:80\u0022, \u0022evidence_snippet\u0022: \u0022CONNECT 172.67.140.99:80 HTTP\/1.1\\r\\nHost: 172.67.140.99:80\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 77 % \u2014 Score WAF 8\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 87 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_dangerous_method\u0022, \u0022http_method_uncommon\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"172.67.140.99:80","http_user_agent":null,"http_referer":null,"tags":"[\u0022http_dangerous_method\u0022, \u0022http_method_uncommon\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":91},{"id":7254083,"ip":"151.243.11.203","ts":"2026-10-23 17:50:25.000000","proto":"tcp","src_port":48672,"dst_port":9000,"service":"http","classification":"web_probe","waf_score":0,"waf_tags":"[]","http_method":"CONNECT","http_target":"raw.bunnyfeet.baby:80","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 2, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: \u00228902f5961aaf4d3214be5e977893d9a1a320ab95\u0022, \u0022http_target_hash\u0022: \u00228902f5961aaf4d3214be5e977893d9a1a320ab95\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 101, \u0022payload_entropy\u0022: 4.92905105785977, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 40, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b80a574c77118c7197f63cb73fb4d19a4aa43718\u0022, \u0022event_fingerprint\u0022: \u0022d927d32a74297d0469f7e4c1b97901cec3139b7b\u0022, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022fc965b77d29417793fa5e8d6b44ee1ac\u0022, \u0022path_pattern_hash\u0022: \u002297a8040fa4d5b4f756bea4e4995b3842\u0022}, \u0022service_name\u0022: \u0022http\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 40}, \u0022payload_preview\u0022: \u0022CONNECT raw.bunnyfeet.baby:80 HTTP\/1.1\\r\\nHost: raw.bunnyfeet.baby:80\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022CONNECT\u0022, \u0022path\u0022: \u0022raw.bunnyfeet.baby:80\u0022, \u0022request_line\u0022: \u0022CONNECT raw.bunnyfeet.baby:80 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022CONNECT raw.bunnyfeet.baby:80 HTTP\/1.1\\r\\nHost: raw.bunnyfeet.baby:80\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022CONNECT raw.bunnyfeet.baby:80 HTTP\/1.1\\r\\nHost: raw.bunnyfeet.baby:80\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022CONNECT\u0022, \u0022path\u0022: \u0022raw.bunnyfeet.baby:80\u0022, \u0022request_line\u0022: \u0022CONNECT raw.bunnyfeet.baby:80 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022CONNECT raw.bunnyfeet.baby:80 HTTP\/1.1\\r\\nHost: raw.bunnyfeet.baby:80\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022CONNECT raw.bunnyfeet.baby:80 HTTP\/1.1\\r\\nHost: raw.bunnyfeet.baby:80\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022}, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022confidence\u0022: 0.87, \u0022classification_confidence\u0022: 0.87, \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ebeee0b15eaa7bb814fa022cc957d0d576565f94\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_path\u0022: \u0022raw.bunnyfeet.baby:80\u0022, \u0022request_line\u0022: \u0022CONNECT raw.bunnyfeet.baby:80 HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022CONNECT raw.bunnyfeet.baby:80 HTTP\/1.1\\r\\nHost: raw.bunnyfeet.baby:80\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe) \u00b7 \u2192 raw.bunnyfeet.baby:80\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 77 % \u2014 Score WAF 8\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 40\/100\u0022, \u0022confidence_pct\u0022: 87, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 40, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_path\u0022: \u0022raw.bunnyfeet.baby:80\u0022, \u0022request_line\u0022: \u0022CONNECT raw.bunnyfeet.baby:80 HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe) \u00b7 \u2192 raw.bunnyfeet.baby:80\u0022, \u0022evidence_snippet\u0022: \u0022CONNECT raw.bunnyfeet.baby:80 HTTP\/1.1\\r\\nHost: raw.bunnyfeet.baby:80\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 77 % \u2014 Score WAF 8\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 87 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_dangerous_method\u0022, \u0022http_method_uncommon\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"raw.bunnyfeet.baby:80","http_user_agent":null,"http_referer":null,"tags":"[\u0022http_dangerous_method\u0022, \u0022http_method_uncommon\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":101},{"id":7227974,"ip":"151.243.11.203","ts":"2026-10-23 16:34:40.000000","proto":"tcp","src_port":52416,"dst_port":9000,"service":"http","classification":"web_probe","waf_score":0,"waf_tags":"[]","http_method":"CONNECT","http_target":"104.21.40.244:80","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 2, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022244:80\u0022, \u0022http_ua_hash\u0022: null, \u0022http_host_hash\u0022: \u0022bf22a149005b93fe196a61387488f4add7205582\u0022, \u0022http_target_hash\u0022: \u0022bf22a149005b93fe196a61387488f4add7205582\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 91, \u0022payload_entropy\u0022: 4.761248519654219, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 209630, \u0022country\u0022: \u0022AE\u0022, \u0022dst_port\u0022: 9000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 40, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b80a574c77118c7197f63cb73fb4d19a4aa43718\u0022, \u0022event_fingerprint\u0022: \u002257473e3fb0478297d0fdc31f42ea33d7399bf739\u0022, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022AE\u0022, \u0022asn\u0022: 209630, \u0022org\u0022: \u0022LLC Vash Kredit Bank\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022a9b5438c59e3c0fe98103592c829a477\u0022, \u0022path_pattern_hash\u0022: \u0022e9366d67f9063c85310b3b510c9d1828\u0022}, \u0022service_name\u0022: \u0022http\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 40}, \u0022payload_preview\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\\r\\nHost: 104.21.40.244:80\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022CONNECT\u0022, \u0022path\u0022: \u0022104.21.40.244:80\u0022, \u0022request_line\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\\r\\nHost: 104.21.40.244:80\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\\r\\nHost: 104.21.40.244:80\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022CONNECT\u0022, \u0022path\u0022: \u0022104.21.40.244:80\u0022, \u0022request_line\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\\r\\nHost: 104.21.40.244:80\\r\\nProxy-Connection: Keep-Alive\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\\r\\nHost: 104.21.40.244:80\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022}, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022confidence\u0022: 0.87, \u0022classification_confidence\u0022: 0.87, \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002202a20f3dea02f2bac567efd19e50aa709142ea13\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_path\u0022: \u0022104.21.40.244:80\u0022, \u0022request_line\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\\r\\nHost: 104.21.40.244:80\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.21.40.244:80\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 77 % \u2014 Score WAF 8\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 40\/100\u0022, \u0022confidence_pct\u0022: 87, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 40, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022CONNECT\u0022, \u0022http_path\u0022: \u0022104.21.40.244:80\u0022, \u0022request_line\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\u0022, \u0022port\u0022: 9000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022Sonde HTTP \u00b7 via HTTP:9000 \u00b7 (sonde \/ probe) \u00b7 \u2192 104.21.40.244:80\u0022, \u0022evidence_snippet\u0022: \u0022CONNECT 104.21.40.244:80 HTTP\/1.1\\r\\nHost: 104.21.40.244:80\\r\\nProxy-Connection: Keep-Alive\u0022, \u0022target_port_label\u0022: \u00229000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 77 % \u2014 Score WAF 8\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 87 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (151.243.11.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u0022151.243.11.0\/24\u0022, \u0022coordinated_ip_count\u0022: 8, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_dangerous_method\u0022, \u0022http_method_uncommon\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"104.21.40.244:80","http_user_agent":null,"http_referer":null,"tags":"[\u0022http_dangerous_method\u0022, \u0022http_method_uncommon\u0022, \u0022http_no_ua\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":91}],"total_events":134}