Détails IP 16.5.0.217

Synthèse

Score de risque max. 50/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 20/10/2026 06:16 UTC

Dernière observation 24/10/2026 17:13 UTC

Événements (période) 15

Décision conseillée Surveiller Observer, investiguer ou bloquer. Le site ne pousse pas de règle pare-feu.

MITRE ATT&CK principal T1046 8 occurrences

Pourquoi listée

Type « SSRF interne » (signaux protocolaires) · confiance 54%

Confiance 64 % — Score WAF 8 · Bonus corrélation +10

Décision

Investiguer

Risque moyen. Relisez le port dominant et les preuves avant toute règle réseau.

50/100 Confiance 64 % 15 événements T1046

À faire

Lire les preuves de la chronologie avant d’écrire une règle.
Comparer avec les IP du même FAI.
Annoter le verdict vrai positif ou faux positif.

Preuves JSON SOC CEF STIX Ticket nftables

Note de ticket

IP 16.5.0.217
Décision : Investiguer
Score max : 50/100 (Moyen)
Confiance : 64 %
Période : 2026-10-19 → 2026-10-26 · 15 événements
Motif : Type « SSRF interne » (signaux protocolaires) · confiance 54%
MITRE : T1046
FAI : EMBNEX, LLC · Brésil

Comparaison ASN / FAI

ASN 401661 · 16.5.0.0/24 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 15 événements sur la période pour cette IP.

16.5.0.222 SSRF 25/10/2026 07:58 UTC
16.5.0.198 Sonde OpenVPN 25/10/2026 06:39 UTC
16.5.0.212 SSRF 25/10/2026 05:29 UTC
16.5.0.200 SSRF 25/10/2026 03:43 UTC
16.5.0.168 SSRF 24/10/2026 04:06 UTC
16.5.0.171 SSRF 24/10/2026 01:26 UTC
16.5.0.189 SSRF 23/10/2026 11:18 UTC
16.5.0.176 SSRF 23/10/2026 10:36 UTC

Événements (filtres)

Première observation

20/10/2026 06:16 UTC

Dernière observation

24/10/2026 17:13 UTC

Dernière activité (filtres)

24/10/2026 17:13 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

OPENVPN TCP 7 POSTGRES TCP 7 TLS TCP 1

OPENVPN

POSTGRES

TLS

Géolocalisation

Origine réseau déclarée

Brésil unknown unknown

FAI / réseau

Opérateur et dernière activité ban

EMBNEX, LLC 0 Port 6466 Sonde TLS

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Chaîne d'attaque

Reconnaissance

Vecteur d'attaque

ssrf internal · via POSTGRES:5432 · (tentative d'exploit)

Détails protocole

PostgreSQL: Handshake PostgreSQL (startup)

Aperçu payload

/ localhostc�

Port / service

5432 · POSTGRES

Service émulé

POSTGRES

Raison confiance

Confiance 54 % — Motif catalogue confirmé

Technique MITRE

TA0001

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Scan coordonné

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

CRS-920350

Confiance

64% Corrélation +10

Famille de menace

unknown IP signalée (IPsum, 3 listes ou plus) IP malveillante (CINS Army)

MITRE ATT&CK — tactiques observées

Accès initial Exécution

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

15 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

15 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
24/10/2026 17:13:41 UTC	TCP	5432 · POSTGRES	postgres	SSRF interne ssrf internal · via POSTGRES:5432 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0001 Accès Exécution Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_postgresql_probe postgres_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload / localhostc� Pourquoi cette classification : Type « SSRF interne » (signaux protocolaires) · confiance 54% Confiance classification 64% Corrélation +10 Risque capteur Moyen · 46 Confiance : Confiance 54 % — Motif catalogue confirmé Protocole émulé 1 Signaux CRS-920350 Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution User-Agent — Règles WAF — Payload (extrait) / localhostc� Meta JSON brut {"protocol_emulated":true,"bytes_in":18,"payload_entropy":3.6143694458867563,"port_category":"registered","org":"EMBNEX, LLC","service":"postgres","app_proto":"postgres","asn":401661,"country":"BR","dst_port":5432,"risk_waf":8,"risk_classification":80,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.8,"risk_breakdown":{"waf":8,"classification":80,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":46,"tag_count":2,"anomaly_count":0,"campaign_key":"272205ffb91c9631a06988b863bb09a8579d4d67","event_fingerprint":"4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f","classification_reason":"Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%","confidence":0.64,"classification_confidence":0.64,"precision_score":64,"precision_signals":["CRS-920350"],"kb_rule_ids":["CRS-920350"],"confidence_breakdown":{"waf":8,"classification":80,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":46,"correlation_boost":10},"named_classification_skipped":false,"classification_parent":"ssrf_attack","service_name":"postgres","risk_confidence_factor":54,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BR","asn":401661,"org":"EMBNEX, LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c1d61ae61efafa16c783e5ac5975fba3","path_pattern_hash":"2926fa5ba65a298fe7630f4e1d1dd6ea"},"target_context":{"dst_port":5432,"service":"postgres","service_name":"postgres","risk_score":46},"…
24/10/2026 17:13:38 UTC	TCP	5432 · POSTGRES	postgres	Sonde PostgreSQL postgresql probe · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 Découverte Accès Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_postgresql_probe postgres_emulated postgres_startup Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload �/ Pourquoi cette classification : Type « Sonde PostgreSQL » (signaux protocolaires) · confiance 0% Confiance classification 10% Corrélation +10 Risque capteur Faible · 34 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) �/ Meta JSON brut {"protocol_emulated":true,"emulator_response":"0000001252000000057573657200706f73746772657300","emulator_response_len":23,"bytes_in":8,"payload_entropy":2.4056390622295662,"port_category":"registered","org":"EMBNEX, LLC","service":"postgres","app_proto":"postgres","asn":401661,"country":"BR","dst_port":5432,"risk_waf":8,"risk_classification":54,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.2,"risk_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":34,"tag_count":3,"anomaly_count":0,"campaign_key":"12b185c5c936d11db56861a0ba267c300ed0e15e","event_fingerprint":"4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f","classification_reason":"Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.1,"classification_confidence":0.1,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":34,"correlation_boost":10},"named_classification_skipped":false,"service_name":"postgres","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BR","asn":401661,"org":"EMBNEX, LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"694bec2754742b999eb8e010ccd19ce8","path_pattern_hash":"2e6f775d89e58a7f725edffbb3ac7743"},"target_context":{"dst_port":5432,"service":"postgres","service_name…
24/10/2026 17:13:38 UTC	TCP	5432 · POSTGRES	postgres	Sonde PostgreSQL postgresql probe · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 Découverte Accès Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_postgresql_probe postgres_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload �D CKFDENECFDEFFCFGEFFCCACACACACACA CACACACACACACACACACACACACACACAAA Pourquoi cette classification : Type « Sonde PostgreSQL » (signaux protocolaires) · confiance 0% Confiance classification 10% Corrélation +10 Risque capteur Faible · 34 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) �D CKFDENECFDEFFCFGEFFCCACACACACACA CACACACACACACACACACACACACACACAAA Meta JSON brut {"protocol_emulated":true,"bytes_in":72,"payload_entropy":2.5234708113000046,"port_category":"registered","org":"EMBNEX, LLC","service":"postgres","app_proto":"postgres","asn":401661,"country":"BR","dst_port":5432,"risk_waf":8,"risk_classification":54,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.8,"risk_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":34,"tag_count":2,"anomaly_count":0,"campaign_key":"272205ffb91c9631a06988b863bb09a8579d4d67","event_fingerprint":"4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f","classification_reason":"Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.1,"classification_confidence":0.1,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":34,"correlation_boost":10},"named_classification_skipped":false,"service_name":"postgres","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BR","asn":401661,"org":"EMBNEX, LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"abadbb73f5dcca4e6d62483e487521d2","path_pattern_hash":"2e6f775d89e58a7f725edffbb3ac7743"},"target_context":{"dst_port":5432,"service":"postgres","service_name":"postgres","risk_score":34},"payload_preview":"\ufffd\u0000\u0000D CKFDENECFDEFFCFGEFFCCACACA…
24/10/2026 17:13:36 UTC	TCP	5432 · POSTGRES	postgres	Protocole wire MongoDB mongodb wire protocol · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 38
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE T1046 Découverte Accès Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags mongodb_hello_probe mongodb_wire_protocol net_mongodb_wire_protocol postgres_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload :�admin.$cmdismaster Pourquoi cette classification : Type « Protocole wire MongoDB » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +10 Risque capteur Faible · 38 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux ET-PROTO-MongoDB-Wire pat-fb-012 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) Mongo ismaster User-Agent — Règles WAF — Payload (extrait) :�admin.$cmdismaster Meta JSON brut {"protocol_emulated":true,"bytes_in":58,"payload_entropy":2.7335000737311512,"port_category":"registered","org":"EMBNEX, LLC","service":"postgres","app_proto":"postgres","asn":401661,"country":"BR","dst_port":5432,"risk_waf":8,"risk_classification":58,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":10,"risk_boost":0,"risk_granularity":2.9,"risk_breakdown":{"waf":8,"classification":58,"behavior":0,"geo":0,"protocol":36,"novelty":10},"risk_score":38,"tag_count":5,"anomaly_count":0,"campaign_key":"78bf6877dbdbf691271840148e69e0f8c92beecc","event_fingerprint":"fdb44a1a692c14b7af332504e4ee9f68364f09a0","classification_reason":"Type \u00ab mongodb_wire_protocol \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":155,"precision_signals":["ET-PROTO-MongoDB-Wire","pat-fb-012","INT-upstream"],"kb_rule_ids":["ET-PROTO-MongoDB-Wire","pat-fb-012","INT-upstream"],"matched_patterns":["pat-fb-012"],"matched_pattern_names":["Mongo ismaster"],"pattern_ids":["pat-fb-012"],"confidence_breakdown":{"waf":8,"classification":58,"behavior":0,"geo":0,"protocol":36,"novelty":10,"risk_score":38,"correlation_boost":10},"named_classification_skipped":false,"classification_parent":"mongodb_probe","service_name":"postgres","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BR","asn":401661,"org":"EMBNEX, LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_ha…
24/10/2026 17:13:36 UTC	TCP	5432 · POSTGRES	postgres	Sonde PostgreSQL postgresql probe · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 Découverte Accès Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_postgresql_probe postgres_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload OPTIONS sip:62.3.50.33:5432 SIP/2.0 Via: SIP/2.0/TCP 62.3.50.33:5432;branch=z9hG4bKab839815 Max-Forwards: 70 From: <sip:scann Pourquoi cette classification : Type « Sonde PostgreSQL » (signaux protocolaires) · confiance 0% Confiance classification 10% Corrélation +10 Risque capteur Faible · 34 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) OPTIONS sip:62.3.50.33:5432 SIP/2.0 Via: SIP/2.0/TCP 62.3.50.33:5432;branch=z9hG4bKab839815 Max-Forwards: 70 From: <sip:scann Requête brute (extrait) OPTIONS sip:62.3.50.33:5432 SIP/2.0 Via: SIP/2.0/TCP 62.3.50.33:5432;branch=z9hG4bKab839815 Max-Forwards: 70 From: <sip:scanner@62.3.50.33>;tag=ab839815 To: <sip:62.3.50.33:5432> Call-ID: ab839815@62.3.50.33 CSeq: 1 OPTIONS Contact: <sip:scanner@62. Meta JSON brut {"protocol_emulated":true,"bytes_in":317,"payload_entropy":5.323667560643165,"port_category":"registered","org":"EMBNEX, LLC","service":"postgres","app_proto":"postgres","asn":401661,"country":"BR","dst_port":5432,"risk_waf":8,"risk_classification":54,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.8,"risk_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":36,"novelty":15},"risk_score":34,"tag_count":2,"anomaly_count":0,"campaign_key":"272205ffb91c9631a06988b863bb09a8579d4d67","event_fingerprint":"4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f","classification_reason":"Type \u00ab postgresql_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.1,"classification_confidence":0.1,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":36,"novelty":15,"risk_score":34,"correlation_boost":10},"named_classification_skipped":false,"service_name":"postgres","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BR","asn":401661,"org":"EMBNEX, LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"913338479620253b224b3258561e0cae","path_pattern_hash":"2e6f775d89e58a7f725edffbb3ac7743"},"target_context":{"dst_port":5432,"service":"postgres","service_name":"postgres","risk_score":34},"payload_preview":"OPTIONS sip:62.3.50.33:5432 SIP\/2.0\r\nVia…
24/10/2026 17:13:32 UTC	TCP	5432 · POSTGRES	postgres	Protocole TDS MSSQL mssql tds · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 Découverte Accès Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags mssql_tds net_mssql_tds postgres_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload index� Pourquoi cette classification : Type « Protocole TDS MSSQL » (signaux protocolaires) · confiance 0% Confiance classification 10% Corrélation +10 Risque capteur Faible · 21 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) index� Meta JSON brut {"protocol_emulated":true,"bytes_in":24,"payload_entropy":2.143155878465832,"port_category":"registered","org":"EMBNEX, LLC","service":"postgres","app_proto":"postgres","asn":401661,"country":"BR","dst_port":5432,"risk_waf":8,"risk_classification":56,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.2,"risk_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":21,"tag_count":3,"anomaly_count":0,"campaign_key":"0a70a95076b6bb288ed8cb609fc21c76ea95d13a","event_fingerprint":"c3e011e0870136aab299eddf4a9dbde006a3e9cb","classification_reason":"Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.1,"classification_confidence":0.1,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":21,"correlation_boost":10},"named_classification_skipped":false,"service_name":"postgres","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BR","asn":401661,"org":"EMBNEX, LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"168cd266e33a684eab3da20176978e94","path_pattern_hash":"285321e27377a1f85e5a231ca6cbffb2"},"target_context":{"dst_port":5432,"service":"postgres","service_name":"postgres","risk_score":21},"payload_preview":"\u0012\u0002index\u0000\u0000\u0000\u0000\u0000\u0000\…
24/10/2026 17:13:32 UTC	TCP	5432 · POSTGRES	postgres	Sonde PostgreSQL postgresql probe · via POSTGRES:5432 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 Découverte Accès Protocole Handshake PostgreSQL (startup) Émulateur POSTGRES WAF — Recommandation Surveiller Tags net_postgresql_probe postgres_emulated ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5432 Chemin / cible — Service POSTGRES Payload SSH-2.0-FlowIQ_1.0 �.curve25519-sha256,curve25519-sha256@libssh.orgqssh-ed25519,rsa-sha2-512,rsa-sha Pourquoi cette classification : Bannière client SSH reçue · confiance 0% Confiance classification 10% Corrélation +10 Risque capteur Faible · 34 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) SSH-2.0-FlowIQ_1.0 �.curve25519-sha256,curve25519-sha256@libssh.orgqssh-ed25519,rsa-sha2-512,rsa-sha Requête brute (extrait) SSH-2.0-FlowIQ_1.0 �.curve25519-sha256,curve25519-sha256@libssh.orgqssh-ed25519,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss�chacha20-poly1305@openssh.com,aes128-ctr,ae Meta JSON brut {"protocol_emulated":true,"bytes_in":740,"payload_entropy":4.900696794969122,"port_category":"registered","org":"EMBNEX, LLC","service":"postgres","app_proto":"postgres","asn":401661,"country":"BR","dst_port":5432,"risk_waf":8,"risk_classification":54,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":15,"risk_boost":0,"risk_granularity":2.2,"risk_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":36,"novelty":15},"risk_score":34,"tag_count":3,"anomaly_count":0,"campaign_key":"287a753c83ad12c18f0fa979d29867fabce561f9","event_fingerprint":"4ccb9ae5aa8fe2eee37acc0e9b054ffd0269442f","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 0%","confidence":0.1,"classification_confidence":0.1,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":36,"novelty":15,"risk_score":34,"correlation_boost":10},"named_classification_skipped":false,"service_name":"postgres","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BR","asn":401661,"org":"EMBNEX, LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c12830ff04b0c3570e597703d1963b4f","path_pattern_hash":"2e6f775d89e58a7f725edffbb3ac7743"},"target_context":{"dst_port":5432,"service":"postgres","service_name":"postgres","risk_score":34},"payload_preview":"SSH-2.0-FlowIQ_1.0\r\n\u0000\u0000\u0002\ufffd\b\u0014\u0000\u0000\…
21/10/2026 08:00:59 UTC	TCP	6466 · TLS	tls	Sonde TLS tls probe · via TLS:6466 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 Découverte Accès Protocole JA3 df0d0b7e3986fe1a Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6466 Chemin / cible — Service TLS Payload ��W?�ڇ��hC��+��g�)�Q�8\|f�� <��h�i��~W�Y��x[X;s�,r�L<�,�+̩�0�/̨�z#- Pourquoi cette classification : Type « Sonde TLS » (signaux protocolaires) · confiance 50% Confiance classification 60% Corrélation +10 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) ��W?�ڇ��hC��+��g�)�Q�8\|f�� <��h�i��~W�Y��x[X;s�,r�L<�,�+̩�0�/̨�z#- Requête brute (extrait) ��W?�ڇ��hC��+��g�)�Q�8\|f�� <��h�i��~W�Y��x[X;s�,r�L<�,�+̩�0�/̨�z#- 3&$ ��'� "��>�` e��3 �,�&�;�W�_xi+ Meta JSON brut {"tls_ja3_hash":"df0d0b7e3986fe1a6611e07fa79eca45","tls_sni":null,"bytes_in":224,"payload_entropy":5.870818112890533,"port_category":"registered","org":"EMBNEX, LLC","service":"tls","app_proto":"tls","asn":401661,"country":"BR","dst_port":6466,"risk_waf":8,"risk_classification":32,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":0,"risk_granularity":3.6,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":35,"tag_count":2,"anomaly_count":0,"campaign_key":"f38347477227b3a98538c71955e8aa061553665c","event_fingerprint":"9b3d702d60d032f7f46cb767fcaee292842ffc47","classification_confidence":0.6,"confidence":0.6,"precision_signals":["pat-0554"],"classification_reason":"Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":35,"correlation_boost":10},"service_name":"tls","risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BR","asn":401661,"org":"EMBNEX, LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"df0d0b7e3986fe1a6611e07fa79eca45","payload_hash":"2e2fb0ea9490655dc1b94aec2bb173d8","path_pattern_hash":"8792d2cfdc5028123bfb8f159de8656c","ja4":"7e07e550c1f8e49ad7f5bb0c3731a654","tls_version":"0x0303","tls_cipher_count":10,"ja3_client_category":"nmap_scanner"},"tls_ja3":"771,4866-4865-4867-49196-4919…
20/10/2026 06:16:58 UTC	TCP	1194 · OPENVPN	openvpn	Sonde OpenVPN openvpn probe · via OPENVPN:1194 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE T1046 Découverte Accès Protocole Émulateur OPENVPN WAF — Recommandation Investiguer Tags net_openvpn_probe openvpn_emulated wireguard_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1194 Chemin / cible — Service OPENVPN Payload / localhostc� Pourquoi cette classification : Type « Sonde OpenVPN » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +10 Risque capteur Moyen · 50 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Openvpn Pkt Vpn Openvpn Pkt Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) / localhostc� Meta JSON brut {"protocol_emulated":true,"emulator_response":"380000000000000000","emulator_response_len":9,"bytes_in":18,"payload_entropy":3.6143694458867563,"port_category":"registered","org":"EMBNEX, LLC","service":"openvpn","app_proto":"openvpn","asn":401661,"country":"BR","dst_port":1194,"risk_waf":8,"risk_classification":46,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.6,"risk_breakdown":{"waf":8,"classification":46,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":50,"tag_count":3,"anomaly_count":0,"campaign_key":"a68283091efaa6f80eb430c2fb90b8417f4a1a6b","event_fingerprint":"3a7ecaf9104d633c1b2b6cfa11ec7d30d1b69370","classification_reason":"Type \u00ab openvpn_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":131,"precision_signals":["INT-openvpn_pkt","INT-VPN-openvpn-pkt","INT-upstream"],"kb_rule_ids":["INT-openvpn_pkt","INT-VPN-openvpn-pkt","INT-upstream"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":46,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":50,"correlation_boost":10},"named_classification_skipped":false,"service_name":"openvpn","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BR","asn":401661,"org":"EMBNEX, LLC","is_datacenter":false,"is_tor_hint":false}…
20/10/2026 06:16:58 UTC	TCP	1194 · OPENVPN	openvpn	Sonde OpenVPN openvpn probe · via OPENVPN:1194 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE T1046 Découverte Accès Protocole Émulateur OPENVPN WAF — Recommandation Investiguer Tags net_openvpn_probe openvpn_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1194 Chemin / cible — Service OPENVPN Payload head Pourquoi cette classification : Type « Sonde OpenVPN » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +10 Risque capteur Moyen · 50 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux Openvpn Pkt Vpn Openvpn Pkt Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) head Meta JSON brut {"protocol_emulated":true,"emulator_response":"380000000000000000","emulator_response_len":9,"bytes_in":5,"payload_entropy":2.321928094887362,"port_category":"registered","org":"EMBNEX, LLC","service":"openvpn","app_proto":"openvpn","asn":401661,"country":"BR","dst_port":1194,"risk_waf":8,"risk_classification":46,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.3,"risk_breakdown":{"waf":8,"classification":46,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":50,"tag_count":2,"anomaly_count":0,"campaign_key":"2efe01a5352b8e3c11273a98def287670150d7d7","event_fingerprint":"3a7ecaf9104d633c1b2b6cfa11ec7d30d1b69370","classification_reason":"Type \u00ab openvpn_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":131,"precision_signals":["INT-openvpn_pkt","INT-VPN-openvpn-pkt","INT-upstream"],"kb_rule_ids":["INT-openvpn_pkt","INT-VPN-openvpn-pkt","INT-upstream"],"confidence_breakdown":{"waf":8,"classification":46,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":50,"correlation_boost":10},"named_classification_skipped":false,"service_name":"openvpn","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BR","asn":401661,"org":"EMBNEX, LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"5b8ebdda7e9bcbaf9653a7971850a515","path_pattern_hash":"6c07e36460e62c833d0e82829ad83…
20/10/2026 06:16:58 UTC	TCP	1194 · OPENVPN	openvpn	Sonde OpenVPN openvpn probe · via OPENVPN:1194 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE T1046 Découverte Accès Protocole Émulateur OPENVPN WAF — Recommandation Investiguer Tags net_openvpn_probe openvpn_emulated wireguard_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1194 Chemin / cible — Service OPENVPN Payload ��SMBr(/KbPC NETWORK PROGRAM 1.0LANMAN1.0Windows for Workgroups 3.1aLM1.2X002LANMAN2.1NT Pourquoi cette classification : Type « Sonde OpenVPN » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +10 Risque capteur Moyen · 50 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Openvpn Pkt Vpn Openvpn Pkt Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) ��SMBr(/KbPC NETWORK PROGRAM 1.0LANMAN1.0Windows for Workgroups 3.1aLM1.2X002LANMAN2.1NT Requête brute (extrait) ��SMBr(/KbPC NETWORK PROGRAM 1.0LANMAN1.0Windows for Workgroups 3.1aLM1.2X002LANMAN2.1NT LM 0.12 Meta JSON brut {"protocol_emulated":true,"emulator_response":"380000000000000000","emulator_response_len":9,"bytes_in":137,"payload_entropy":4.59625882081699,"port_category":"registered","org":"EMBNEX, LLC","service":"openvpn","app_proto":"openvpn","asn":401661,"country":"BR","dst_port":1194,"risk_waf":8,"risk_classification":46,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":3.6,"risk_breakdown":{"waf":8,"classification":46,"behavior":0,"geo":0,"protocol":30,"novelty":15},"risk_score":50,"tag_count":3,"anomaly_count":0,"campaign_key":"a68283091efaa6f80eb430c2fb90b8417f4a1a6b","event_fingerprint":"3a7ecaf9104d633c1b2b6cfa11ec7d30d1b69370","classification_reason":"Type \u00ab openvpn_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":131,"precision_signals":["INT-openvpn_pkt","INT-VPN-openvpn-pkt","INT-upstream"],"kb_rule_ids":["INT-openvpn_pkt","INT-VPN-openvpn-pkt","INT-upstream"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":46,"behavior":0,"geo":0,"protocol":30,"novelty":15,"risk_score":50,"correlation_boost":10},"named_classification_skipped":false,"service_name":"openvpn","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BR","asn":401661,"org":"EMBNEX, LLC","is_datacenter":false,"is_tor_hint":fals…
20/10/2026 06:16:57 UTC	TCP	1194 · OPENVPN	openvpn	Sonde OpenVPN openvpn probe · via OPENVPN:1194 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE T1046 Découverte Accès Protocole Émulateur OPENVPN WAF — Recommandation Investiguer Tags mongodb_probe net_openvpn_probe openvpn_emulated wireguard_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1194 Chemin / cible — Service OPENVPN Payload �(�� Pourquoi cette classification : Type « Sonde OpenVPN » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +10 Risque capteur Moyen · 50 Confiance : Confiance 100 % — 4 signal(aux) capteur Protocole émulé 1 Signaux Openvpn Pkt Vpn Openvpn Pkt Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) NFS RPC mount Mumble ping STUN binding Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �(�� Meta JSON brut {"protocol_emulated":true,"emulator_response":"380000000000000000","emulator_response_len":9,"bytes_in":44,"payload_entropy":1.1385838901844965,"port_category":"registered","org":"EMBNEX, LLC","service":"openvpn","app_proto":"openvpn","asn":401661,"country":"BR","dst_port":1194,"risk_waf":8,"risk_classification":46,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":4,"risk_breakdown":{"waf":8,"classification":46,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":50,"tag_count":4,"anomaly_count":0,"campaign_key":"46281b956c89a725da829477561e0db9c7293d64","event_fingerprint":"3a7ecaf9104d633c1b2b6cfa11ec7d30d1b69370","classification_reason":"Type \u00ab openvpn_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":131,"precision_signals":["INT-openvpn_pkt","INT-VPN-openvpn-pkt","INT-upstream"],"kb_rule_ids":["INT-openvpn_pkt","INT-VPN-openvpn-pkt","INT-upstream"],"matched_patterns":["pat-0532","pat-0768","pat-0771","pat-0554","pat-0536"],"matched_pattern_names":["NFS RPC mount","Mumble ping","STUN binding","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0532","pat-0768","pat-0771","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":46,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":50,"correlation_boost":10},"named_classification_skipped":false,"service_name":"openvpn","risk_confidence_factor":100,"city":nu…
20/10/2026 06:16:57 UTC	TCP	1194 · OPENVPN	openvpn	Sonde OpenVPN openvpn probe · via OPENVPN:1194 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE T1046 Découverte Accès Protocole Émulateur OPENVPN WAF — Recommandation Investiguer Tags net_openvpn_probe openvpn_emulated wireguard_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1194 Chemin / cible — Service OPENVPN Payload EHLO 62.3.50.33 STARTTLS Pourquoi cette classification : Type « Sonde OpenVPN » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +10 Risque capteur Moyen · 50 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux Openvpn Pkt Vpn Openvpn Pkt Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) SMTP EHLO SMTPS EHLO User-Agent — Règles WAF — Payload (extrait) EHLO 62.3.50.33 STARTTLS Meta JSON brut {"protocol_emulated":true,"emulator_response":"380000000000000000","emulator_response_len":9,"bytes_in":27,"payload_entropy":3.930270372293454,"port_category":"registered","org":"EMBNEX, LLC","service":"openvpn","app_proto":"openvpn","asn":401661,"country":"BR","dst_port":1194,"risk_waf":8,"risk_classification":46,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.6,"risk_breakdown":{"waf":8,"classification":46,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":50,"tag_count":3,"anomaly_count":0,"campaign_key":"a68283091efaa6f80eb430c2fb90b8417f4a1a6b","event_fingerprint":"3a7ecaf9104d633c1b2b6cfa11ec7d30d1b69370","classification_reason":"Type \u00ab openvpn_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":131,"precision_signals":["INT-openvpn_pkt","INT-VPN-openvpn-pkt","INT-upstream"],"kb_rule_ids":["INT-openvpn_pkt","INT-VPN-openvpn-pkt","INT-upstream"],"matched_patterns":["pat-0401","pat-0629"],"matched_pattern_names":["SMTP EHLO","SMTPS EHLO"],"pattern_ids":["pat-0401","pat-0629"],"confidence_breakdown":{"waf":8,"classification":46,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":50,"correlation_boost":10},"named_classification_skipped":false,"service_name":"openvpn","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BR","asn":401661,"org":"EMBNEX, LLC","is_datacenter":false,"is…
20/10/2026 06:16:49 UTC	TCP	1194 · OPENVPN	openvpn	Sonde OpenVPN openvpn probe · via OPENVPN:1194 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE T1046 Découverte Accès Protocole Émulateur OPENVPN WAF — Recommandation Investiguer Tags net_openvpn_probe openvpn_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1194 Chemin / cible — Service OPENVPN Pourquoi cette classification : Type « Sonde OpenVPN » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +10 Risque capteur Moyen · 50 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux Openvpn Pkt Vpn Openvpn Pkt Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"380000000000000000","emulator_response_len":9,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"EMBNEX, LLC","service":"openvpn","app_proto":"openvpn","asn":401661,"country":"BR","dst_port":1194,"risk_waf":8,"risk_classification":46,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.3,"risk_breakdown":{"waf":8,"classification":46,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":50,"tag_count":2,"anomaly_count":0,"campaign_key":"2efe01a5352b8e3c11273a98def287670150d7d7","event_fingerprint":"3a7ecaf9104d633c1b2b6cfa11ec7d30d1b69370","classification_reason":"Type \u00ab openvpn_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":131,"precision_signals":["INT-openvpn_pkt","INT-VPN-openvpn-pkt","INT-upstream"],"kb_rule_ids":["INT-openvpn_pkt","INT-VPN-openvpn-pkt","INT-upstream"],"confidence_breakdown":{"waf":8,"classification":46,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":50,"correlation_boost":10},"named_classification_skipped":false,"service_name":"openvpn","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BR","asn":401661,"org":"EMBNEX, LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"6c07e36460e62c833d0e82829ad833da"},"target_context":{"dst_port":11…
20/10/2026 06:16:41 UTC	TCP	1194 · OPENVPN	openvpn	Sonde OpenVPN openvpn probe · via OPENVPN:1194 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole Émulateur OPENVPN WAF — Recommandation Investiguer Tags net_openvpn_probe openvpn_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1194 Chemin / cible — Service OPENVPN Pourquoi cette classification : Type « Sonde OpenVPN » (signaux protocolaires) · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux Openvpn Pkt Vpn Openvpn Pkt Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"380000000000000000","emulator_response_len":9,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"EMBNEX, LLC","service":"openvpn","app_proto":"openvpn","asn":401661,"country":"BR","dst_port":1194,"risk_waf":8,"risk_classification":46,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.3,"risk_breakdown":{"waf":8,"classification":46,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":50,"tag_count":2,"anomaly_count":0,"campaign_key":"2efe01a5352b8e3c11273a98def287670150d7d7","event_fingerprint":"3a7ecaf9104d633c1b2b6cfa11ec7d30d1b69370","classification_reason":"Type \u00ab openvpn_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":131,"precision_signals":["INT-openvpn_pkt","INT-VPN-openvpn-pkt","INT-upstream"],"kb_rule_ids":["INT-openvpn_pkt","INT-VPN-openvpn-pkt","INT-upstream"],"confidence_breakdown":{"waf":8,"classification":46,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"openvpn","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BR","asn":401661,"org":"EMBNEX, LLC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"6c07e36460e62c833d0e82829ad833da"},"target_context":{"dst_port":1194,"service":"openvpn",…

16.5.0.217

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence