Fiche IP

Royaume-Uni

151.245.210.4

Activité suspecte — risque 42/100 (Moyen) — MITRE T1046 — confiance 100 % — via REDIS — multi-protocole (4 protocoles · 5 min)

FAI British Telecommunications Limited Première vue 30/10/2026 03:53 UTC Dernière vue 30/10/2026 06:36 UTC Risque Moyen

Période 2026-10-04 → 2026-11-03

Moyen 59/100

24h 7j 30j 90j

Synthèse

Score de risque max. 59/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 30/10/2026 03:53 UTC

Dernière observation 30/10/2026 06:36 UTC

Événements (période) 17

Décision conseillée Surveiller Observer, investiguer ou bloquer. Le site ne pousse pas de règle pare-feu.

MITRE ATT&CK principal TA0007 10 occurrences

Pourquoi listée

Type « Scan de ports » (signaux protocolaires) · confiance 100%

Confiance 100 % — Score WAF 8 · Bonus corrélation +8

Décision

Investiguer

Risque moyen. Relisez le port dominant et les preuves avant toute règle réseau.

59/100 Confiance 100 % 17 événements TA0007

À faire

Lire les preuves de la chronologie avant d’écrire une règle.
Comparer avec les IP du même FAI.
Annoter le verdict vrai positif ou faux positif.

Preuves JSON SOC CEF STIX Ticket nftables

Note de ticket

IP 151.245.210.4
Décision : Investiguer
Score max : 59/100 (Moyen)
Confiance : 100 %
Période : 2026-10-04 → 2026-11-03 · 17 événements
Motif : Type « Scan de ports » (signaux protocolaires) · confiance 100%
MITRE : TA0007
FAI : British Telecommunications Limited · Royaume-Uni

Comparaison ASN / FAI

ASN 2856 · 151.245.208.0/22 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 17 événements sur la période pour cette IP.

86.148.123.56 Sonde fichier configuration 03/11/2026 02:19 UTC
109.153.80.225 Sonde API 03/11/2026 02:19 UTC
109.180.105.59 Sonde fichier configuration 02/11/2026 07:02 UTC
86.149.215.64 Sonde API 01/11/2026 18:59 UTC
86.130.70.1 Traversal LFI 21/10/2026 19:01 UTC
86.152.213.213 Sonde Consul 07/08/2026 12:28 UTC
195.104.240.250 Sonde H323 07/08/2026 07:34 UTC
51.9.17.217 Agent personnel 06/08/2026 14:22 UTC

Événements (filtres)

Première observation

30/10/2026 03:53 UTC

Dernière observation

30/10/2026 06:36 UTC

Dernière activité (filtres)

30/10/2026 06:36 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 5 DOCKER TLS TCP 2 ZOOKEEPER TCP 1 MYSQL TCP 1 GIT DAEMON TCP 1 EXEC TCP 1 FTP TCP 1 KERBEROS TCP 1 Telnet TCP 1 HTTP ALT 8010 TCP 1 REDIS TCP 1 HTTPS TCP 1

HTTP

DOCKER TLS

ZOOKEEPER

MYSQL

GIT DAEMON

EXEC

Géolocalisation

Origine réseau déclarée

Royaume-Uni unknown unknown

FAI / réseau

Opérateur et dernière activité ban

British Telecommunications Limited 0 Port 7001 Tentative d'exploit

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Reconnaissance

Chaîne d'attaque

Reconnaissance

Vecteur d'attaque

port scan syn · via REDIS:6379 · (reconnaissance)

Détails protocole

Aperçu payload

PING

Port / service

6379 · REDIS

Service émulé

REDIS

Raison confiance

Confiance 100 % — 3 signal(aux) capteur

Technique MITRE

T1046

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S

Confiance

100% Corrélation +8

Famille de menace

scanner

MITRE ATT&CK — tactiques observées

Reconnaissance

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

17 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

17 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
30/10/2026 06:36:40 UTC	TCP	6379 · REDIS	redis	Scan de ports port scan syn · via REDIS:6379 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole Sonde protocole Redis Émulateur REDIS WAF — Recommandation Surveiller Tags net_redis_probe redis_emulated redis_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6379 Chemin / cible — Service REDIS Redis Sonde protocole Redis Payload PING Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) PING Meta JSON brut {"protocol_emulated":true,"emulator_response":"2b504f4e470d0a","emulator_response_len":7,"bytes_in":6,"payload_entropy":2.584962500721156,"port_category":"registered","org":"British Telecommunications Limited","service":"redis","app_proto":"redis","asn":2856,"country":"GB","dst_port":6379,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.9,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"e8e4c53df412231b4f8dfa80c50a0435a9af47fa","event_fingerprint":"9c536ce82edfb6f83700eeb7934e9ac49a41747b","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"service_name":"redis","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"GB","asn":2856,"org":"British Telecommunications Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"dedee95a5c3354a76fa11ee26963cbe7","path_p…
30/10/2026 06:36:16 UTC	TCP	88 · KERBEROS	kerberos	Sonde Kerberos kerberos probe · via KERBEROS:88 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Émulateur KERBEROS WAF — Recommandation Surveiller Tags kerberos_probe net_kerberos_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 88 Chemin / cible — Service KERBEROS Payload pjn0l �d��0vh_nonexist_user�EXAMPLE�0krbtgtEXAMPLE�20261030073621Z�Tjo<� Pourquoi cette classification : Type « Sonde Kerberos » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 34 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) pjn0l �d��0vh_nonexist_user�EXAMPLE�0krbtgtEXAMPLE�20261030073621Z�Tjo<� Meta JSON brut {"protocol_emulated":true,"emulator_response":"6e82000c0a104142434445464748494a","emulator_response_len":16,"bytes_in":116,"payload_entropy":5.546800336263105,"port_category":"well_known","org":"British Telecommunications Limited","service":"kerberos","app_proto":"kerberos","asn":2856,"country":"GB","dst_port":88,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.9,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":30,"novelty":15},"risk_score":34,"tag_count":2,"anomaly_count":0,"campaign_key":"625a7caba09c020587afb5baab6578817623eb7e","event_fingerprint":"6ad851ec1a17b8199f34f994a26e79201b14171d","classification_reason":"Type \u00ab kerberos_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":30,"novelty":15,"risk_score":34,"correlation_boost":8},"named_classification_skipped":false,"service_name":"kerberos","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"GB","asn":2856,"org":"British Telecommunications Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"3e9feb95f9290abe89b4410f52f108ca","path_pattern_hash":"cb259a77651a21549ec4092bb8c2db19"},"target_context":{"dst_port":88,"servic…
30/10/2026 06:36:04 UTC	TCP	21 · FTP	ftp	Sonde FTP ftp probe · via FTP:21 · (sonde / probe)	Élevée	Moyen · 48
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1595 Découverte Accès Protocole Sonde protocole FTP Émulateur FTP WAF — Recommandation Surveiller Tags ftp_auth_attempt ftp_auth_probe ftp_emulated net_ftp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 21 Chemin / cible — Service FTP Payload USER test Pourquoi cette classification : Type « Sonde FTP » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 48 Confiance : Confiance 95 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Tentative FTP anonyme Upstream Technique MITRE T1595 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) USER test Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420465450205365727665722072656164792e0d0a3333312050617373776f726420726571756972656420666f7220757365722e0d0a","emulator_response_len":65,"bytes_in":11,"payload_entropy":3.277613436819116,"port_category":"well_known","org":"British Telecommunications Limited","service":"ftp","app_proto":"ftp","asn":2856,"country":"GB","dst_port":21,"risk_waf":8,"risk_classification":46,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":10,"risk_boost":0,"risk_granularity":5.1,"risk_breakdown":{"waf":8,"classification":46,"behavior":0,"geo":0,"protocol":36,"novelty":10},"risk_score":48,"tag_count":5,"anomaly_count":0,"campaign_key":"e566a551dace5ca775e068b072341a2eed7d5f94","event_fingerprint":"07fdc90e0dd65f1bc1a6bace3f4b4df61a0c8659","classification_reason":"Type \u00ab ftp_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":77,"precision_signals":["INT-ftp-anonymous","INT-upstream"],"kb_rule_ids":["INT-ftp-anonymous","INT-upstream"],"confidence_breakdown":{"waf":8,"classification":46,"behavior":0,"geo":0,"protocol":36,"novelty":10,"risk_score":48,"correlation_boost":8},"named_classification_skipped":false,"service_name":"ftp","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"GB","asn":2856,"org":"British Telecommunications Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"pa…
30/10/2026 06:34:24 UTC	TCP	9418 · GIT DAEMON	git-daemon	Sonde Git daemon git-daemon · via GIT DAEMON:9418 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Émulateur GIT-DAEMON WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9418 Chemin / cible — Service GIT DAEMON Pourquoi cette classification : Type « Sonde Git daemon » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f74206769745f6461656d6f6e20726561647920706f72743d393431380d0a","emulator_response_len":41,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"British Telecommunications Limited","service":"git-daemon","app_proto":"git-daemon","asn":2856,"country":"GB","dst_port":9418,"risk_waf":8,"risk_classification":0,"risk_behavior":0,"risk_geo":0,"risk_protocol":22,"risk_novelty":0,"risk_boost":0,"risk_granularity":4,"risk_breakdown":{"waf":8,"classification":0,"behavior":0,"geo":0,"protocol":22,"novelty":0},"risk_score":0,"tag_count":0,"anomaly_count":0,"campaign_key":"e6e85b5ced676b7269900bd67d5c350ace1830cb","event_fingerprint":"14a1643be47982abb397e6a0c37cdad51edec3f3","classification_reason":"Type \u00ab git-daemon \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":0,"behavior":0,"geo":0,"protocol":22,"novelty":0,"risk_score":0,"correlation_boost":8},"named_classification_skipped":false,"service_name":"git-daemon","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"GB","asn":2856,"org":"British Telecommunications Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"d7f3bed97b7b24d27e553f9899b847a8"},"target_context":{"dst_port":9418,…
30/10/2026 06:31:33 UTC	TCP	2181 · ZOOKEEPER	zookeeper	Sonde ZooKeeper zookeeper · via ZOOKEEPER:2181 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Émulateur ZOOKEEPER WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2181 Chemin / cible — Service ZOOKEEPER Pourquoi cette classification : Type « Sonde ZooKeeper » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"5a6f6f6b65657065722076657273696f6e3a20332e382e332d2d312c206275696c74206f6e20323032332d31302d30352031303a3030205554430d0a","emulator_response_len":60,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"British Telecommunications Limited","service":"zookeeper","app_proto":"zookeeper","asn":2856,"country":"GB","dst_port":2181,"risk_waf":8,"risk_classification":0,"risk_behavior":0,"risk_geo":0,"risk_protocol":22,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.8,"risk_breakdown":{"waf":8,"classification":0,"behavior":0,"geo":0,"protocol":22,"novelty":0},"risk_score":0,"tag_count":0,"anomaly_count":0,"campaign_key":"799665ba2feb5b28e885503d11fc53fcc5d6a97c","event_fingerprint":"a14d5f3d8510c5c8ed26794618586d29bf6943c9","classification_reason":"Type \u00ab zookeeper \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":0,"behavior":0,"geo":0,"protocol":22,"novelty":0,"risk_score":0,"correlation_boost":8},"named_classification_skipped":false,"service_name":"zookeeper","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"GB","asn":2856,"org":"British Telecommunications Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"456831beef3fc1500939995d7369695f"…
30/10/2026 06:28:44 UTC	TCP	7001 · HTTP	http	Sonde Exchange exchange probe · via HTTP:7001 · (sonde / probe) · → /ecp/	Élevée	Moyen · 48
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole GET /ecp/ UA Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefo… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_exchange_probe Cible HTTP GET /ecp/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /ecp/ Service HTTP Pourquoi cette classification : Type « Sonde Exchange » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 48 Confiance : Confiance 50 % — 3 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET /ecp/ HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /ecp/ HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0 C Requête brute (extrait) GET /ecp/ HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0 Connection: close Accept: / Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Accept-Encoding: gzip Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043","emulator_response_len":177,"http_header_count":6,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"880d0c120dbf4497314046742f2cb6dbd4be704d","http_host_hash":"1e75f7b986cff91f40ab57cbc92b6aed66f05c5b","http_target_hash":"ee89593881279ce7a5db35ab87033c6694f90ad0","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":226,"payload_entropy":5.393374023886559,"port_category":"registered","org":"British Telecommunications Limited","service":"http","app_proto":"http","asn":2856,"country":"GB","dst_port":7001,"risk_waf":84,"risk_classification":54,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":5.9,"risk_breakdown":{"waf":84,"classification":54,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":48,"tag_count":5,"anomaly_count":0,"campaign_key":"f01212dd3164418b0165e77e0165b64da0b67ca1","event_fingerprint":"e47c38419c1ec6e67ad6ebbcc669a14456e0a6bd","classification_reason":"Type \u00ab exchange_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence":0.58,"classification_confidence":0.58,"precision_score":55,"precision_signals":…
30/10/2026 06:28:43 UTC	TCP	7001 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:7001 · (tentative d'exploit) · → /prod-api/druid/	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 Accès Exécution Protocole GET /prod-api/druid/ UA Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefo… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 net_web_probe Cible HTTP GET /prod-api/druid/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /prod-api/druid/ Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 52 Confiance : Confiance 62 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /prod-api/druid/ HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /prod-api/druid/ HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firef Requête brute (extrait) GET /prod-api/druid/ HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0 Connection: close Accept: / Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Accept-Encoding: gzip Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043","emulator_response_len":177,"http_header_count":6,"http_query_params":0,"http_path_depth":2,"http_path_ext":null,"http_ua_hash":"880d0c120dbf4497314046742f2cb6dbd4be704d","http_host_hash":"1e75f7b986cff91f40ab57cbc92b6aed66f05c5b","http_target_hash":"bc67dd791769cf541cda7314cb0d2c91ceec6ffd","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":237,"payload_entropy":5.422961643081627,"port_category":"registered","org":"British Telecommunications Limited","service":"http","app_proto":"http","asn":2856,"country":"GB","dst_port":7001,"risk_waf":84,"risk_classification":72,"risk_behavior":0,"risk_geo":0,"risk_protocol":33,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.6,"risk_breakdown":{"waf":84,"classification":72,"behavior":0,"geo":0,"protocol":33,"novelty":15},"risk_score":52,"tag_count":4,"anomaly_count":0,"campaign_key":"040b6029d745bd5fabff8fd7e8d1d3603102b8df","event_fingerprint":"3e817d044b3e7cc89ccb11fcc6b97ae0cbf6bc06","classification_reason":"Tentative d'exploit (tag rce-0) \u00b7 confiance 62%","confidence":0.7,"classification_confidence":0.7,"precision_score":73,"precision_signals":["MITRE-T1190"],"kb_rule_ids…
30/10/2026 06:28:43 UTC	TCP	7001 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:7001 · (tentative d'exploit) · → /e/admin/	Élevée	Moyen · 59
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 Accès Exécution Protocole GET /e/admin/ UA Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefo… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_admin_panel_probe Cible HTTP GET /e/admin/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /e/admin/ Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 59 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /e/admin/ HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /e/admin/ HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126. Requête brute (extrait) GET /e/admin/ HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0 Connection: close Accept: / Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Accept-Encoding: gzip Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043","emulator_response_len":177,"http_header_count":6,"http_query_params":0,"http_path_depth":2,"http_path_ext":null,"http_ua_hash":"880d0c120dbf4497314046742f2cb6dbd4be704d","http_host_hash":"1e75f7b986cff91f40ab57cbc92b6aed66f05c5b","http_target_hash":"483eae3ddfc57f25c5220d66105b14cb07c6f454","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":230,"payload_entropy":5.417493954395245,"port_category":"registered","org":"British Telecommunications Limited","service":"http","app_proto":"http","asn":2856,"country":"GB","dst_port":7001,"risk_waf":84,"risk_classification":74,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":6.6,"risk_breakdown":{"waf":84,"classification":74,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":59,"tag_count":7,"anomaly_count":0,"campaign_key":"c3759b856d7cc98798e7c51636ce89216c601f7e","event_fingerprint":"ec1e02629990eb6037c97c4c937b592ebd19d0dd","classification_reason":"Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence":…
30/10/2026 06:28:43 UTC	TCP	7001 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:7001 · (tentative d'exploit) · → /uc_server/	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 Accès Exécution Protocole GET /uc_server/ UA Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefo… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 net_web_probe Cible HTTP GET /uc_server/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7001 Chemin / cible /uc_server/ Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 52 Confiance : Confiance 62 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /uc_server/ HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /uc_server/ HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/12 Requête brute (extrait) GET /uc_server/ HTTP/1.1 Host: 62.3.50.33:7001 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0 Connection: close Accept: / Accept-Language: zh-CN,zh;q=0.9,en;q=0.8 Accept-Encoding: gzip Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a205765624c6f676963205365727665722031342e312e312e300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2037390d0a0d0a3c68746d6c3e3c7469746c653e5765624c6f676963205365727665722043","emulator_response_len":177,"http_header_count":6,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"880d0c120dbf4497314046742f2cb6dbd4be704d","http_host_hash":"1e75f7b986cff91f40ab57cbc92b6aed66f05c5b","http_target_hash":"b5a33405af616a2068d71f4d0f0c27fce5f31426","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":232,"payload_entropy":5.414924120418567,"port_category":"registered","org":"British Telecommunications Limited","service":"http","app_proto":"http","asn":2856,"country":"GB","dst_port":7001,"risk_waf":84,"risk_classification":72,"risk_behavior":0,"risk_geo":0,"risk_protocol":33,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.6,"risk_breakdown":{"waf":84,"classification":72,"behavior":0,"geo":0,"protocol":33,"novelty":15},"risk_score":52,"tag_count":4,"anomaly_count":0,"campaign_key":"040b6029d745bd5fabff8fd7e8d1d3603102b8df","event_fingerprint":"ea10d67a24ddd9c5e165a65c1eaa2deda573b1bc","classification_reason":"Tentative d'exploit (tag rce-0) \u00b7 confiance 62%","confidence":0.7,"classification_confidence":0.7,"precision_score":73,"precision_signals":["MITRE-T1190"],"kb_rule_ids…
30/10/2026 06:27:45 UTC	TCP	8443 · HTTPS	https	Scan de ports port scan syn · via HTTPS:8443 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 d49c326cc51a0b8d Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8443 Chemin / cible — Service HTTPS Payload ��g�@@�u�Fn��MR�εp@ۓ��~�Te^6�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3��=<5/W� Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +13 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) ��g�@@�u�Fn��MR�εp@ۓ��~�Te^6�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3��=<5/W� Requête brute (extrait) ��g�@@�u�Fn��MR�εp@ۓ��~�Te^6�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3��=<5/W� # *( Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"bytes_in":191,"payload_entropy":5.149334844010827,"port_category":"registered","org":"British Telecommunications Limited","service":"https","app_proto":"https","asn":2856,"country":"GB","dst_port":8443,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":33,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.8,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":33,"novelty":15},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"841a7de3c3cbd932ffe2df923d0bb6a948309046","event_fingerprint":"48aa5a12dd4150e072f6d3dd03f9143ac67f8d69","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":33,"novelty":15,"risk_score":42,"correlation_boost":13},"named_classification_skipped":false,"service_name":"https","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"GB","asn":2856,"…
30/10/2026 06:27:25 UTC	TCP	2376 · DOCKER TLS	docker-tls	Sonde Docker TLS docker tls probe · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole JA3 d49c326cc51a0b8d Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_api_probe docker_tls_emulated docker_tls_payload net_docker_tls_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Service DOCKER TLS Payload ��v2��i��ٰ��EK ��r�&i"�M6�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3��=<5/W� Pourquoi cette classification : Type « Sonde Docker TLS » (signaux protocolaires) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 62 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Docker Tls Upstream Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) ��v2��i��ٰ��EK��r�&i"�M6�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3��=<5/W� Requête brute (extrait) ��v2��i��ٰ��EK ��r�&i"�M6�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3��=<5/W� # *( Meta JSON brut {"protocol_emulated":true,"emulator_response":"15030300020228","emulator_response_len":7,"bytes_in":191,"payload_entropy":5.1197235448509515,"port_category":"registered","org":"British Telecommunications Limited","service":"docker-tls","app_proto":"docker-tls","asn":2856,"country":"GB","dst_port":2376,"risk_waf":8,"risk_classification":44,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":25,"risk_boost":0,"risk_granularity":5,"risk_breakdown":{"waf":8,"classification":44,"behavior":0,"geo":0,"protocol":30,"novelty":25},"risk_score":45,"tag_count":5,"anomaly_count":0,"campaign_key":"8b17215afa683664673e4e271716fbb0ba8f91d8","event_fingerprint":"0e1c691ada97ecfe1cd84524e4db6b819b7ed10b","classification_reason":"Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%","confidence":0.7,"classification_confidence":0.7,"precision_score":69,"precision_signals":["INT-docker-tls","INT-upstream"],"kb_rule_ids":["INT-docker-tls","INT-upstream"],"confidence_breakdown":{"waf":8,"classification":44,"behavior":0,"geo":0,"protocol":30,"novelty":25,"risk_score":45,"correlation_boost":8},"named_classification_skipped":false,"service_name":"docker-tls","risk_confidence_factor":62,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"GB","asn":2856,"org":"British Telecommunications Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"7959ec5597017100106f30d797519752","path_pattern_hash":"d32a2cff6903ffd31fff3…
30/10/2026 06:26:56 UTC	TCP	23 · Telnet	telnet	Sonde Telnet (23/TCP) port 23 tcp · via Telnet:23 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur TELNET WAF — Recommandation Surveiller Tags net_telnet_probe telnet_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 23 Chemin / cible — Preuve honeypot — Sonde Telnet (23/TCP) Connexion détectée sur le port 23 (TCP) du capteur simulé. Service Telnet Pourquoi cette classification : Type « Sonde Telnet (23/TCP) » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Moyen · 42 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"fffb01fffb03fffd180d0a5562756e74752032322e3034204c54530d0a686f6e6579706f74206c6f67696e3a20","emulator_response_len":45,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"well_known","org":"British Telecommunications Limited","service":"telnet","app_proto":"telnet","asn":2856,"country":"GB","dst_port":23,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.4,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":42,"tag_count":2,"anomaly_count":0,"campaign_key":"ee98e358747c5d752a0eb3d3b34c59d0ffe7f883","event_fingerprint":"79b983d64b1c5573cc70fb9163374500a6810d67","classification_reason":"Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":42},"named_classification_skipped":true,"named_candidate":"telnet_probe","service_name":"telnet","risk_confidence_factor":55,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"GB","asn":2856,"org":"British Telecommunications Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"2bb94c377622e6c9a2e704e9148568af"},"target_context":{"d…
30/10/2026 04:00:18 UTC	TCP	2376 · DOCKER TLS	docker-tls	Sonde Docker TLS docker tls probe · via DOCKER TLS:2376 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Émulateur DOCKER-TLS WAF — Recommandation Surveiller Tags docker_tls_emulated net_docker_tls_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2376 Chemin / cible — Service DOCKER TLS Pourquoi cette classification : Type « Sonde Docker TLS » (signaux protocolaires) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 62 % — 2 signal(aux) capteur Protocole émulé 1 Signaux Docker Tls Upstream Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"15030300020228","emulator_response_len":7,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"British Telecommunications Limited","service":"docker-tls","app_proto":"docker-tls","asn":2856,"country":"GB","dst_port":2376,"risk_waf":8,"risk_classification":44,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.9,"risk_breakdown":{"waf":8,"classification":44,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":45,"tag_count":2,"anomaly_count":0,"campaign_key":"f21ba41294d0290ba258c221013f4610a4db2a27","event_fingerprint":"0e1c691ada97ecfe1cd84524e4db6b819b7ed10b","classification_reason":"Type \u00ab docker_tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 62%","confidence":0.7,"classification_confidence":0.7,"precision_score":69,"precision_signals":["INT-docker-tls","INT-upstream"],"kb_rule_ids":["INT-docker-tls","INT-upstream"],"confidence_breakdown":{"waf":8,"classification":44,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":45,"correlation_boost":8},"named_classification_skipped":false,"service_name":"docker-tls","risk_confidence_factor":62,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"GB","asn":2856,"org":"British Telecommunications Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"d32a2cff6903ffd31fff36df36da58ae"},"target_context":{"dst_port…
30/10/2026 03:58:56 UTC	TCP	512 · EXEC	exec	Sonde rexec exec · via EXEC:512 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Émulateur EXEC WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 512 Chemin / cible — Service EXEC Pourquoi cette classification : Type « Sonde rexec » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f74206578656320726561647920706f72743d3531320d0a","emulator_response_len":34,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"well_known","org":"British Telecommunications Limited","service":"exec","app_proto":"exec","asn":2856,"country":"GB","dst_port":512,"risk_waf":8,"risk_classification":0,"risk_behavior":0,"risk_geo":0,"risk_protocol":22,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.6,"risk_breakdown":{"waf":8,"classification":0,"behavior":0,"geo":0,"protocol":22,"novelty":0},"risk_score":0,"tag_count":0,"anomaly_count":0,"campaign_key":"3bb57e5f23ed12639bb27756ec7c9e4d43e7331c","event_fingerprint":"01510fb0d79138946866f7b3409c378dc6ef9cf0","classification_reason":"Type \u00ab exec \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":0,"behavior":0,"geo":0,"protocol":22,"novelty":0,"risk_score":0,"correlation_boost":8},"named_classification_skipped":false,"service_name":"exec","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"GB","asn":2856,"org":"British Telecommunications Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"2706c619fe73f0cf112473c6ee02e66c"},"target_context":{"dst_port":512,"service":"exec","service_name":"exec"…
30/10/2026 03:54:15 UTC	TCP	3306 · MYSQL	mysql	Scan de ports port scan syn · via MYSQL:3306 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole Émulateur MYSQL WAF — Recommandation Surveiller Tags mysql_emulated mysql_handshake net_mysql_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3306 Chemin / cible — Service MYSQL Payload HEAD / HTTP/1.0 Host: 62.3.50.33 Pourquoi cette classification : Poignée de main MySQL · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) HEAD / HTTP/1.0 Host: 62.3.50.33 Meta JSON brut {"protocol_emulated":true,"emulator_response":"380000000a382e302e33322d4d7953514c0004030201112233445566778899aabbccddeeff006d7973716c5f6e61746976655f70617373776f726400","emulator_response_len":60,"bytes_in":37,"payload_entropy":4.1885226220933465,"port_category":"registered","org":"British Telecommunications Limited","service":"mysql","app_proto":"mysql","asn":2856,"country":"GB","dst_port":3306,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.2,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"bef1cad8d681313ebc2fad5890e78941ae733f15","event_fingerprint":"7e64d2ea7efbfd080eb620b69c685e7503a67a61","classification_reason":"Poign\u00e9e de main MySQL \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"service_name":"mysql","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"GB","asn":2856,"org":"British Telecommunications Limited","is_datacenter":false,"is_tor_hint":…
30/10/2026 03:53:56 UTC	TCP	500 · HTTP	http	Sonde HTTP http · via HTTP:500 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole HEAD / Émulateur HTTP WAF 3 Recommandation Surveiller Tags 950734:sap-sapcontrol-path http_no_ua Cible HTTP HEAD / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode HEAD Port 500 Chemin / cible / Service HTTP Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 61% Confiance classification 69% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 61 % — Score WAF 20 · 1 tag(s) WAF Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `HEAD / HTTP/1.1` User-Agent — Règles WAF sap-sapcontrol-path Payload (extrait) HEAD / HTTP/1.0 Host: 62.3.50.33 Meta JSON brut {"http_header_count":1,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":null,"http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"HEAD","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":37,"payload_entropy":4.1885226220933465,"port_category":"well_known","org":"British Telecommunications Limited","service":"http","app_proto":"http","asn":2856,"country":"GB","dst_port":500,"risk_waf":20,"risk_classification":8,"risk_behavior":0,"risk_geo":0,"risk_protocol":35,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.3,"risk_breakdown":{"waf":20,"classification":8,"behavior":0,"geo":0,"protocol":35,"novelty":0},"risk_score":35,"tag_count":2,"anomaly_count":0,"campaign_key":"6b47ce484bf14f885967329838d056ebf92e2343","event_fingerprint":"c3b5edc70ae32675d8f4b4a5326b64e58f228910","city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"GB","asn":2856,"org":"British Telecommunications Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"408fdd968fb97c649fd3e6ddf5626ca1","path_pattern_hash":"8a5edab282632443219e051e4ade2d1d"},"service_name":"http","target_context":{"dst_port":500,"service":"http","service_name":"http","risk_score":35},"payload_preview":"HEAD \/ HTTP\/1.0\r\nHost: 62.3.50.33\r\n\r\n","method":"HEAD","path":"\/","waf_tags":["950734:sap-sapcontrol-path"],"waf_rule_names":["sap-sapcon…
30/10/2026 03:53:29 UTC	TCP	8010 · HTTP ALT 8010	http-alt-8010	Sonde HTTP 8010 http-alt-8010 · via HTTP ALT 8010:8010 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur HTTP-ALT-8010 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8010 Chemin / cible — Service HTTP ALT 8010 Pourquoi cette classification : Type « Sonde HTTP 8010 » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"British Telecommunications Limited","service":"http-alt-8010","app_proto":"http-alt-8010","asn":2856,"country":"GB","dst_port":8010,"risk_waf":8,"risk_classification":0,"risk_behavior":0,"risk_geo":0,"risk_protocol":22,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.9,"risk_breakdown":{"waf":8,"classification":0,"behavior":0,"geo":0,"protocol":22,"novelty":0},"risk_score":0,"tag_count":0,"anomaly_count":0,"campaign_key":"e45d04116002e45e0727e0bc764d20f784c49b73","event_fingerprint":"3c8bec9ff6243353dd9f4241f81b225f3feb7ea2","classification_reason":"Type \u00ab http-alt-8010 \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":0,"behavior":0,"geo":0,"protocol":22,"novelty":0,"risk_score":0},"named_classification_skipped":false,"service_name":"http-alt-8010","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"GB","asn":2856,"org":"British Telecommunications Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"7…

151.245.210.4

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence