Renseignement sur les menaces

Seychelles

160.119.71.136

FAI Alsycon B.V. Première vue 28/06/2026 04:37 UTC Dernière vue 16/07/2026 22:00 UTC Risque Élevé

Période analysée : 2026-04-17 → 2026-07-16

Activité suspecte — risque 52/100 (Moyen) — MITRE TA0001 — confiance 95 % — via FIREBIRD

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Élevé · Risque max (7j) Élevé

Synthèse exécutive

Profil de menace

Score de risque 76/100 Élevé

Première observation 28/06/2026 04:37 UTC

Dernière observation 16/07/2026 22:00 UTC

Événements (période) 4,274

MITRE ATT&CK principal TA0001 3711 occurrences

Activité suspecte — risque 52/100 (Moyen) — MITRE TA0001 — confiance 95 % — via FIREBIRD

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%

Confiance 95 % — Score WAF 8

Comparaison ASN / FAI

ASN 7489 · 160.119.64.0/20 · AFRINIC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 4,274 événements sur la période pour cette IP.

160.119.71.135 Sonde port 16/07/2026 22:11 UTC
160.119.71.92 Sonde port 16/07/2026 22:09 UTC
160.119.76.7 Sonde port 1723/TCP 16/07/2026 15:17 UTC
185.224.128.16 Sonde HTTP 16/07/2026 14:52 UTC
160.119.71.9 grafana probe 13/07/2026 22:28 UTC
160.119.76.210 Sonde port 12/07/2026 18:12 UTC
160.119.76.85 Sonde SIP/VoIP 11/07/2026 13:28 UTC
160.119.76.10 Sonde port 1723/TCP 29/06/2026 17:10 UTC

Événements (filtres)

4,274

Première observation

28/06/2026 04:37 UTC

Dernière observation

16/07/2026 22:00 UTC

Dernière activité (filtres)

16/07/2026 22:00 UTC

Événements 7j

2,573

Ports distincts (7j)

368

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 2,611 SAP ICM TCP 847 POSTGRES TCP 14 KAFKA SSL TCP 14 GITHUB WEBHOOK TCP 14 BITTORRENT TRACKER TCP 14 ELITE TCP 14 ACTIVEMQ JMX TCP 14 ROCKETMQ TCP 14 ECHO TCP 14 CONSUL TCP 14 FLINK TCP 14 SPLUNK TCP 11 ELASTICSEARCH TCP 7 STRATUM TCP 7 GAME UNREAL TCP 7 AWS ECS AGENT TCP 7 RTSP TCP 7 IOT PROBE TCP 7 ELASTICSEARCH TRANSPORT TCP 7

HTTP

2,611

SAP ICM

847

POSTGRES

KAFKA SSL

GITHUB WEBHOOK

BITTORRENT TRACKER

Géolocalisation

Origine réseau déclarée

Seychelles unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Alsycon B.V. 0 Port 3050 firebird_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Chaîne d'attaque

Exploitation

Vecteur d'attaque

http smuggling probe · via FIREBIRD:3050 · (tentative d'exploit)

Détails protocole

Aperçu payload

POST /api/route HTTP/1.1 Host: 62.3.50.33:3050 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.

Port / service

3050 · FIREBIRD

Service émulé

FIREBIRD

Raison confiance

Confiance 95 % — Motif catalogue confirmé

Technique MITRE

TA0001

Persona capteur

mail.sensor-1.internal

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0842

Confiance

95%

Famille de menace

web_injection

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

4,274 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

4274 événement(s) — page 1/86

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
16/07/2026 22:00:28 UTC	TCP	3050 · FIREBIRD	firebird	Sonde HTTP smuggling http smuggling probe · via FIREBIRD:3050 · (tentative d'exploit)	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur FIREBIRD WAF — Recommandation Investiguer Tags firebird_emulated firebird_payload mozi_pattern net_firebird_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3050 Chemin / cible — Service FIREBIRD Payload POST /_next/server HTTP/1.1 Host: 62.3.50.33:3050 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 52 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL User-Agent — Règles WAF — Payload (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:3050 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT Requête brute (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:3050 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: po Meta JSON brut { "protocol_emulated": true, "emulator_response": "000000090000000003", "emulator_response_len": 9, "bytes_in": 921, "payload_entropy": 5.612483484458075, "port_category": "registered", "org": "Alsycon B.V.", "service": "firebird", "app_proto": "firebird", "asn": 49870, "country": "SC", "dst_port": 3050, "risk_waf": 8, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 52, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ab03b99004393e3ebc9b094953b8d30e20f7d98b", "event_fingerprint": "ccb7e0f3a022cfd04a51e40ccd64f2e9875c39ed", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 52 }, "named_classification_skipped": false, "service_name": "firebird", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b77d805d5661b969e0961291113d8b32", "path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a" }, "target_context": { "dst_port": 3050, "service": "firebird", "service_name": "firebird", "risk_score": 52 }, "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT ", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: po", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT", "evidence": { "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: po", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b932c8ab4005fab5e0437b49d66ad2fbc5f1a2f8", "protocol_details": { "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT", "port": 3050, "service": "firebird", "service_label_fr": "FIREBIRD" }, "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT", "attack_vector": "http smuggling probe \u00b7 via FIREBIRD:3050 \u00b7 (tentative d'exploit)", "target_port_label": "3050 \u00b7 FIREBIRD", "emulator_service": "firebird", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via FIREBIRD", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 52 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "firebird", "service_label_fr": "FIREBIRD", "dst_port": 3050, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-firebird", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT", "port": 3050, "service": "firebird", "service_label_fr": "FIREBIRD" }, "attack_vector": "http smuggling probe \u00b7 via FIREBIRD:3050 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT", "target_port_label": "3050 \u00b7 FIREBIRD", "emulator_service": "firebird", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "firebird", "service_banner": "honeypot-firebird", "service_os": "linux", "dst_port": "3050" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "firebird_emulated", "firebird_payload", "mozi_pattern", "net_firebird_probe" ] }
16/07/2026 22:00:28 UTC	TCP	3050 · FIREBIRD	firebird	Sonde HTTP smuggling http smuggling probe · via FIREBIRD:3050 · (tentative d'exploit)	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur FIREBIRD WAF — Recommandation Investiguer Tags firebird_emulated firebird_payload mozi_pattern net_firebird_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3050 Chemin / cible — Service FIREBIRD Payload POST /app HTTP/1.1 Host: 62.3.50.33:3050 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 52 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL User-Agent — Règles WAF — Payload (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3050 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win Requête brute (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3050 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: poop1234 C Meta JSON brut { "protocol_emulated": true, "emulator_response": "000000090000000003", "emulator_response_len": 9, "bytes_in": 906, "payload_entropy": 5.605843194903964, "port_category": "registered", "org": "Alsycon B.V.", "service": "firebird", "app_proto": "firebird", "asn": 49870, "country": "SC", "dst_port": 3050, "risk_waf": 8, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 52, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ab03b99004393e3ebc9b094953b8d30e20f7d98b", "event_fingerprint": "ccb7e0f3a022cfd04a51e40ccd64f2e9875c39ed", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 52 }, "named_classification_skipped": false, "service_name": "firebird", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "fe3686003bac086be17debcb5f4f76cd", "path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a" }, "target_context": { "dst_port": 3050, "service": "firebird", "service_name": "firebird", "risk_score": 52 }, "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nC", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win", "evidence": { "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nC", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e44cd95f059810f473645b1d1f93983f49c2b4b5", "protocol_details": { "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win", "port": 3050, "service": "firebird", "service_label_fr": "FIREBIRD" }, "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win", "attack_vector": "http smuggling probe \u00b7 via FIREBIRD:3050 \u00b7 (tentative d'exploit)", "target_port_label": "3050 \u00b7 FIREBIRD", "emulator_service": "firebird", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via FIREBIRD", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 52 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "firebird", "service_label_fr": "FIREBIRD", "dst_port": 3050, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-firebird", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win", "port": 3050, "service": "firebird", "service_label_fr": "FIREBIRD" }, "attack_vector": "http smuggling probe \u00b7 via FIREBIRD:3050 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win", "target_port_label": "3050 \u00b7 FIREBIRD", "emulator_service": "firebird", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "firebird", "service_banner": "honeypot-firebird", "service_os": "linux", "dst_port": "3050" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "firebird_emulated", "firebird_payload", "mozi_pattern", "net_firebird_probe" ] }
16/07/2026 22:00:28 UTC	TCP	3050 · FIREBIRD	firebird	Sonde HTTP smuggling http smuggling probe · via FIREBIRD:3050 · (tentative d'exploit)	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur FIREBIRD WAF — Recommandation Investiguer Tags firebird_emulated firebird_payload mozi_pattern net_firebird_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3050 Chemin / cible — Service FIREBIRD Payload POST /api/route HTTP/1.1 Host: 62.3.50.33:3050 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10. Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 52 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL User-Agent — Règles WAF — Payload (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:3050 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10. Requête brute (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:3050 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Actio Meta JSON brut { "protocol_emulated": true, "emulator_response": "000000090000000003", "emulator_response_len": 9, "bytes_in": 950, "payload_entropy": 5.640429256522991, "port_category": "registered", "org": "Alsycon B.V.", "service": "firebird", "app_proto": "firebird", "asn": 49870, "country": "SC", "dst_port": 3050, "risk_waf": 8, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 52, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ab03b99004393e3ebc9b094953b8d30e20f7d98b", "event_fingerprint": "ccb7e0f3a022cfd04a51e40ccd64f2e9875c39ed", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 52 }, "named_classification_skipped": false, "service_name": "firebird", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5e94f8e428ad6f84418af7a818c41959", "path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a" }, "target_context": { "dst_port": 3050, "service": "firebird", "service_name": "firebird", "risk_score": 52 }, "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.", "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.", "evidence": { "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "754ed4c6f0c55d530c2cdaa127b796c8e2f21b29", "protocol_details": { "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.", "port": 3050, "service": "firebird", "service_label_fr": "FIREBIRD" }, "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.", "attack_vector": "http smuggling probe \u00b7 via FIREBIRD:3050 \u00b7 (tentative d'exploit)", "target_port_label": "3050 \u00b7 FIREBIRD", "emulator_service": "firebird", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via FIREBIRD", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 52 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "firebird", "service_label_fr": "FIREBIRD", "dst_port": 3050, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-firebird", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.", "port": 3050, "service": "firebird", "service_label_fr": "FIREBIRD" }, "attack_vector": "http smuggling probe \u00b7 via FIREBIRD:3050 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.", "target_port_label": "3050 \u00b7 FIREBIRD", "emulator_service": "firebird", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "firebird", "service_banner": "honeypot-firebird", "service_os": "linux", "dst_port": "3050" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "firebird_emulated", "firebird_payload", "mozi_pattern", "net_firebird_probe" ] }
16/07/2026 22:00:27 UTC	TCP	3050 · FIREBIRD	firebird	Sonde HTTP smuggling http smuggling probe · via FIREBIRD:3050 · (tentative d'exploit)	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur FIREBIRD WAF — Recommandation Investiguer Tags firebird_emulated firebird_payload mozi_pattern net_firebird_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3050 Chemin / cible — Service FIREBIRD Payload POST /api HTTP/1.1 Host: 62.3.50.33:3050 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 145 Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 52 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL User-Agent — Règles WAF — Payload (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:3050 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 145 Requête brute (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:3050 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X Meta JSON brut { "protocol_emulated": true, "emulator_response": "000000090000000003", "emulator_response_len": 9, "bytes_in": 937, "payload_entropy": 5.626965925375245, "port_category": "registered", "org": "Alsycon B.V.", "service": "firebird", "app_proto": "firebird", "asn": 49870, "country": "SC", "dst_port": 3050, "risk_waf": 8, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 52, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ab03b99004393e3ebc9b094953b8d30e20f7d98b", "event_fingerprint": "ccb7e0f3a022cfd04a51e40ccd64f2e9875c39ed", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 52 }, "named_classification_skipped": false, "service_name": "firebird", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "92836589c9922b475c1bd1fb645f8178", "path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a" }, "target_context": { "dst_port": 3050, "service": "firebird", "service_name": "firebird", "risk_score": 52 }, "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145", "evidence": { "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "34c937b3834d01443ee15e0848c4a5b9296617be", "protocol_details": { "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145", "port": 3050, "service": "firebird", "service_label_fr": "FIREBIRD" }, "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145", "attack_vector": "http smuggling probe \u00b7 via FIREBIRD:3050 \u00b7 (tentative d'exploit)", "target_port_label": "3050 \u00b7 FIREBIRD", "emulator_service": "firebird", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via FIREBIRD", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 52 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "firebird", "service_label_fr": "FIREBIRD", "dst_port": 3050, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-firebird", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145", "port": 3050, "service": "firebird", "service_label_fr": "FIREBIRD" }, "attack_vector": "http smuggling probe \u00b7 via FIREBIRD:3050 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145", "target_port_label": "3050 \u00b7 FIREBIRD", "emulator_service": "firebird", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "firebird", "service_banner": "honeypot-firebird", "service_os": "linux", "dst_port": "3050" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "firebird_emulated", "firebird_payload", "mozi_pattern", "net_firebird_probe" ] }
16/07/2026 22:00:26 UTC	TCP	3050 · FIREBIRD	firebird	Sonde HTTP smuggling http smuggling probe · via FIREBIRD:3050 · (tentative d'exploit)	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur FIREBIRD WAF — Recommandation Investiguer Tags firebird_emulated firebird_payload mozi_pattern net_firebird_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3050 Chemin / cible — Service FIREBIRD Payload POST /_next HTTP/1.1 Host: 62.3.50.33:3050 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 52 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL User-Agent — Règles WAF — Payload (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:3050 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android Requête brute (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:3050 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gzip, Meta JSON brut { "protocol_emulated": true, "emulator_response": "000000090000000003", "emulator_response_len": 9, "bytes_in": 963, "payload_entropy": 5.6695567254997, "port_category": "registered", "org": "Alsycon B.V.", "service": "firebird", "app_proto": "firebird", "asn": 49870, "country": "SC", "dst_port": 3050, "risk_waf": 8, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 52, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ab03b99004393e3ebc9b094953b8d30e20f7d98b", "event_fingerprint": "ccb7e0f3a022cfd04a51e40ccd64f2e9875c39ed", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 52 }, "named_classification_skipped": false, "service_name": "firebird", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ced0624faa5963a154da3d7265db863f", "path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a" }, "target_context": { "dst_port": 3050, "service": "firebird", "service_name": "firebird", "risk_score": 52 }, "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android ", "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, ", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android", "evidence": { "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, ", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bfa45ba08e1c55da14ad7190389b3f69300f135a", "protocol_details": { "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android", "port": 3050, "service": "firebird", "service_label_fr": "FIREBIRD" }, "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android", "attack_vector": "http smuggling probe \u00b7 via FIREBIRD:3050 \u00b7 (tentative d'exploit)", "target_port_label": "3050 \u00b7 FIREBIRD", "emulator_service": "firebird", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via FIREBIRD", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 52 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "firebird", "service_label_fr": "FIREBIRD", "dst_port": 3050, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-firebird", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android", "port": 3050, "service": "firebird", "service_label_fr": "FIREBIRD" }, "attack_vector": "http smuggling probe \u00b7 via FIREBIRD:3050 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android", "target_port_label": "3050 \u00b7 FIREBIRD", "emulator_service": "firebird", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "firebird", "service_banner": "honeypot-firebird", "service_os": "linux", "dst_port": "3050" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "firebird_emulated", "firebird_payload", "mozi_pattern", "net_firebird_probe" ] }
16/07/2026 22:00:25 UTC	TCP	3050 · FIREBIRD	firebird	firebird probe firebird probe · via FIREBIRD:3050 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur FIREBIRD WAF — Recommandation Surveiller Tags firebird_emulated net_firebird_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3050 Chemin / cible — Service FIREBIRD Pourquoi cette classification : Type « firebird_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "000000090000000003", "emulator_response_len": 9, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Alsycon B.V.", "service": "firebird", "app_proto": "firebird", "asn": 49870, "country": "SC", "dst_port": 3050, "risk_waf": 8, "risk_classification": 52, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 34, "tag_count": 2, "anomaly_count": 0, "campaign_key": "e4596522212c693bd6158bffd566553ff7c85e0b", "event_fingerprint": "ccb7e0f3a022cfd04a51e40ccd64f2e9875c39ed", "classification_reason": "Type \u00ab firebird_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 34 }, "named_classification_skipped": false, "service_name": "firebird", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "6e1650c772b75626cc366734cce9c329" }, "target_context": { "dst_port": 3050, "service": "firebird", "service_name": "firebird", "risk_score": 34 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0c1a2c3dcb951e6d73f450989bb3cb126e1d0786", "protocol_details": { "port": 3050, "service": "firebird", "service_label_fr": "FIREBIRD" }, "attack_vector": "firebird probe \u00b7 via FIREBIRD:3050 \u00b7 (sonde \/ probe)", "target_port_label": "3050 \u00b7 FIREBIRD", "emulator_service": "firebird", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab firebird_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab firebird_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 52, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 34 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "firebird", "service_label_fr": "FIREBIRD", "dst_port": 3050, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-firebird", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 3050, "service": "firebird", "service_label_fr": "FIREBIRD" }, "attack_vector": "firebird probe \u00b7 via FIREBIRD:3050 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "3050 \u00b7 FIREBIRD", "emulator_service": "firebird", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "firebird", "service_banner": "honeypot-firebird", "service_os": "linux", "dst_port": "3050" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "firebird_emulated", "net_firebird_probe" ] }
16/07/2026 22:00:25 UTC	TCP	3050 · FIREBIRD	firebird	Sonde HTTP smuggling http smuggling probe · via FIREBIRD:3050 · (tentative d'exploit)	Élevée	Moyen · 52
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur FIREBIRD WAF — Recommandation Investiguer Tags firebird_emulated firebird_payload mozi_pattern net_firebird_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3050 Chemin / cible — Service FIREBIRD Payload POST / HTTP/1.1 Host: 62.3.50.33:3050 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 95% Risque capteur Moyen · 52 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL User-Agent — Règles WAF — Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3050 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3050 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: Meta JSON brut { "protocol_emulated": true, "emulator_response": "000000090000000003", "emulator_response_len": 9, "bytes_in": 941, "payload_entropy": 5.662296380518599, "port_category": "registered", "org": "Alsycon B.V.", "service": "firebird", "app_proto": "firebird", "asn": 49870, "country": "SC", "dst_port": 3050, "risk_waf": 8, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 52, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ab03b99004393e3ebc9b094953b8d30e20f7d98b", "event_fingerprint": "ccb7e0f3a022cfd04a51e40ccd64f2e9875c39ed", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 52 }, "named_classification_skipped": false, "service_name": "firebird", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "519b76d395d1c41e745ae06b42020581", "path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a" }, "target_context": { "dst_port": 3050, "service": "firebird", "service_name": "firebird", "risk_score": 52 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: ", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "evidence": { "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: ", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f752bdc1a03b1ab5bafd9e978d14397c612d5995", "protocol_details": { "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "port": 3050, "service": "firebird", "service_label_fr": "FIREBIRD" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "attack_vector": "http smuggling probe \u00b7 via FIREBIRD:3050 \u00b7 (tentative d'exploit)", "target_port_label": "3050 \u00b7 FIREBIRD", "emulator_service": "firebird", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via FIREBIRD", "confidence_pct": 95, "confidence_breakdown": { "waf": 8, "classification": 85, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 52 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 52, "risk_label": "Moyen", "service_name": "firebird", "service_label_fr": "FIREBIRD", "dst_port": 3050, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-firebird", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "port": 3050, "service": "firebird", "service_label_fr": "FIREBIRD" }, "attack_vector": "http smuggling probe \u00b7 via FIREBIRD:3050 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3050\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "target_port_label": "3050 \u00b7 FIREBIRD", "emulator_service": "firebird", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "firebird", "service_banner": "honeypot-firebird", "service_os": "linux", "dst_port": "3050" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "firebird_emulated", "firebird_payload", "mozi_pattern", "net_firebird_probe" ] }
16/07/2026 21:37:37 UTC	TCP	8004 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:8004 · (tentative d'exploit) · → /api/route	Élevée	Élevé · 72
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /api/route UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb… Émulateur HTTP WAF 62 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /api/route TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8004 Chemin / cible /api/route Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 72 Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api/route HTTP/1.1` User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:8004 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iP Requête brute (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:8004 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-Enco Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe", "http_host_hash": "1397ca07af082e84dda99de43d53a32d001ddc1b", "http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 975, "payload_entropy": 5.67468850614206, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8004, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 72, "tag_count": 16, "anomaly_count": 0, "campaign_key": "5b054e599cc208b129456528a3871422870a5da7", "event_fingerprint": "21dd29ff13a08abca55105dcc9de2f1584941ee3", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b", "payload_hash": "a8cbe6652184f48e9a83ac82ed5f688a", "path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32" }, "target_context": { "dst_port": 8004, "service": "http", "service_name": "http", "risk_score": 72 }, "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iP", "method": "POST", "path": "\/api\/route", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api\/route HTTP\/1.1", "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Enco", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iP", "evidence": { "method": "POST", "path": "\/api\/route", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api\/route HTTP\/1.1", "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Enco", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iP", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8980c8cfe646125d774df161e98072091ae25c3a", "protocol_details": { "http_method": "POST", "http_path": "\/api\/route", "request_line": "POST \/api\/route HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026", "port": 8004, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iP", "attack_vector": "http smuggling probe \u00b7 via HTTP:8004 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route", "target_port_label": "8004 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 72, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8004, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/api\/route", "request_line": "POST \/api\/route HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026", "port": 8004, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:8004 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route", "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iP", "target_port_label": "8004 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8004" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8004" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_api_route_probe", "http_contenttype_attack_surface", "http_probe_api", "http_prototype_pollution", "http_ssti", "net_web_probe" ] }
16/07/2026 21:37:37 UTC	TCP	8004 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:8004 · (tentative d'exploit) · → /app	Élevée	Élevé · 72
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /app UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like… Émulateur HTTP WAF 52 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /app TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8004 Chemin / cible /app Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 72 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /app HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 Payload (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:8004 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) A Requête brute (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:8004 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-R Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd", "http_host_hash": "1397ca07af082e84dda99de43d53a32d001ddc1b", "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 928, "payload_entropy": 5.643417946361074, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8004, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 72, "tag_count": 12, "anomaly_count": 0, "campaign_key": "c59e0e64ac61f10850708470f3d6edf657bdb2e5", "event_fingerprint": "f00f6b24d773d8bde9bcb150d9e66e8583e96a20", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "72d43eb808798db218d063798749cc39", "payload_hash": "3737a6498a9770119f0426ac08a1cb37", "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe" }, "target_context": { "dst_port": 8004, "service": "http", "service_name": "http", "risk_score": 72 }, "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A", "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-R", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A", "evidence": { "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-R", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7f1ae49fcb5caa938b165e8a020c25131bf8ae12", "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 8004, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A", "attack_vector": "http smuggling probe \u00b7 via HTTP:8004 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "target_port_label": "8004 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 72, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8004, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 8004, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:8004 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A", "target_port_label": "8004 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8004" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8004" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti", "net_web_probe" ] }
16/07/2026 21:37:36 UTC	TCP	8004 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:8004 · (tentative d'exploit) · → /api	Élevée	Élevé · 72
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /api UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 56 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /api TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8004 Chemin / cible /api Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 72 Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:8004 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac Requête brute (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:8004 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Actio Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a", "http_host_hash": "1397ca07af082e84dda99de43d53a32d001ddc1b", "http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 944, "payload_entropy": 5.658179657644291, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8004, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 72, "tag_count": 14, "anomaly_count": 0, "campaign_key": "8f3396a82fecb2c6eea1e1d89af4b16e3c23e8bb", "event_fingerprint": "f88d5f055bd9366ab7babc1fc9332e95f96aeb34", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de", "payload_hash": "711a8caee3ad46bd2cf5d0c2c7c39eaa", "path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221" }, "target_context": { "dst_port": 8004, "service": "http", "service_name": "http", "risk_score": 72 }, "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "evidence": { "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "82205378e1660356aba5aa5bf6da668bcad3e15d", "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 8004, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "attack_vector": "http smuggling probe \u00b7 via HTTP:8004 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "target_port_label": "8004 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 72, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8004, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 8004, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:8004 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "target_port_label": "8004 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8004" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8004" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_contenttype_attack_surface", "http_probe_api", "http_prototype_pollution", "http_ssti", "net_web_probe" ] }
16/07/2026 21:37:36 UTC	TCP	8004 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:8004 · (tentative d'exploit) · → /_next/server	Élevée	Élevé · 72
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /_next/server UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 58 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /_next/server TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8004 Chemin / cible /_next/server Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 72 Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /_next/server HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:8004 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Requête brute (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:8004 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate N Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a", "http_host_hash": "1397ca07af082e84dda99de43d53a32d001ddc1b", "http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 959, "payload_entropy": 5.633598631007555, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8004, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 72, "tag_count": 13, "anomaly_count": 0, "campaign_key": "d7f739125142c79df197cef7b058b69d64488ce7", "event_fingerprint": "db206961638ccd6b03dd3851eb8ac87f259a88b5", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de", "payload_hash": "74c30cb023846ac50499af75c3f8fdd1", "path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056" }, "target_context": { "dst_port": 8004, "service": "http", "service_name": "http", "risk_score": 72 }, "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; ", "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;", "evidence": { "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0ba05a44d8f54f13afa59c114623342c6aeb4ffe", "protocol_details": { "http_method": "POST", "http_path": "\/_next\/server", "request_line": "POST \/_next\/server HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 8004, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;", "attack_vector": "http smuggling probe \u00b7 via HTTP:8004 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server", "target_port_label": "8004 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 72, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8004, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/_next\/server", "request_line": "POST \/_next\/server HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 8004, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:8004 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server", "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;", "target_port_label": "8004 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8004" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8004" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti", "net_web_probe" ] }
16/07/2026 21:37:35 UTC	TCP	8004 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:8004 · (tentative d'exploit)	Élevée	Élevé · 72
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH… Émulateur HTTP WAF 55 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8004 Chemin / cible / Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 72 Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:8004 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541. Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:8004 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Ne Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b", "http_host_hash": "1397ca07af082e84dda99de43d53a32d001ddc1b", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 933, "payload_entropy": 5.665728160982721, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8004, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 72, "tag_count": 13, "anomaly_count": 0, "campaign_key": "904ba5a8303c959071cf58222ae0f4b8208c2632", "event_fingerprint": "0fd5e53101ce6a01518499d83f1288e01d5ee635", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "5ea6889a59d080298a42c0e1b4758211", "payload_hash": "c42cacde9745e5381d1bbb3273136e76", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8004, "service": "http", "service_name": "http", "risk_score": 72 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Ne", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Ne", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1d332d1080014131fc349e3bd16baf2cda05d89d", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 8004, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.", "attack_vector": "http smuggling probe \u00b7 via HTTP:8004 \u00b7 (tentative d'exploit)", "target_port_label": "8004 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 72, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8004, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 8004, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:8004 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.", "target_port_label": "8004 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8004" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8004" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti", "net_web_probe" ] }
16/07/2026 21:37:35 UTC	TCP	8004 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:8004 · (tentative d'exploit) · → /_next	Élevée	Élevé · 72
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /_next UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH… Émulateur HTTP WAF 52 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /_next TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8004 Chemin / cible /_next Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 72 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /_next HTTP/1.1` User-Agent Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:8004 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 1 Requête brute (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:8004 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b", "http_host_hash": "1397ca07af082e84dda99de43d53a32d001ddc1b", "http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 938, "payload_entropy": 5.674446887680444, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8004, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 72, "tag_count": 12, "anomaly_count": 0, "campaign_key": "c59e0e64ac61f10850708470f3d6edf657bdb2e5", "event_fingerprint": "32982caaf741077be0408e2829d95e31d40ae19b", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "5ea6889a59d080298a42c0e1b4758211", "payload_hash": "17d9f80fb7a20943fce6d2f6d8eda32d", "path_pattern_hash": "bfd33612e3863357684bd23d10455a76" }, "target_context": { "dst_port": 8004, "service": "http", "service_name": "http", "risk_score": 72 }, "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1", "method": "POST", "path": "\/_next", "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next HTTP\/1.1", "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1", "evidence": { "method": "POST", "path": "\/_next", "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next HTTP\/1.1", "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3e47071576c764558625de43e4a965f437a9e052", "protocol_details": { "http_method": "POST", "http_path": "\/_next", "request_line": "POST \/_next HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 8004, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1", "attack_vector": "http smuggling probe \u00b7 via HTTP:8004 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next", "target_port_label": "8004 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 72, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8004, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/_next", "request_line": "POST \/_next HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 8004, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:8004 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next", "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8004\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1", "target_port_label": "8004 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8004" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8004" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti", "net_web_probe" ] }
16/07/2026 21:37:34 UTC	TCP	8004 · HTTP ALT 8004	http-alt-8004	http-alt-8004 http-alt-8004 · via HTTP ALT 8004:8004 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur HTTP-ALT-8004 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8004 Chemin / cible — Service HTTP ALT 8004 Pourquoi cette classification : Type « http-alt-8004 » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Alsycon B.V.", "service": "http-alt-8004", "app_proto": "http-alt-8004", "asn": 49870, "country": "SC", "dst_port": 8004, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3655e498a6900252f8c5d3b95612083030efdf4b", "event_fingerprint": "4b1decdc5433fc714f50aea5037261585c0d6999", "classification_reason": "Type \u00ab http-alt-8004 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "http-alt-8004", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "8897835eec14d9ee2cd85c1470ad4cdd" }, "target_context": { "dst_port": 8004, "service": "http-alt-8004", "service_name": "http-alt-8004", "risk_score": 0 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "188ef29b46b7fd075c974e5c4a8eb1e763eb2e71", "protocol_details": { "port": 8004, "service": "http-alt-8004", "service_label_fr": "HTTP ALT 8004" }, "attack_vector": "http-alt-8004 \u00b7 via HTTP ALT 8004:8004 \u00b7 (sonde \/ probe)", "target_port_label": "8004 \u00b7 HTTP ALT 8004", "emulator_service": "http-alt-8004", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab http-alt-8004 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab http-alt-8004 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "http-alt-8004", "service_label_fr": "HTTP ALT 8004", "dst_port": 8004, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http-alt-8004", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 8004, "service": "http-alt-8004", "service_label_fr": "HTTP ALT 8004" }, "attack_vector": "http-alt-8004 \u00b7 via HTTP ALT 8004:8004 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "8004 \u00b7 HTTP ALT 8004", "emulator_service": "http-alt-8004", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http_alt_8004", "service_banner": "honeypot-http-alt-8004", "service_os": "linux", "dst_port": "8004" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
16/07/2026 21:01:38 UTC	TCP	8005 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:8005 · (tentative d'exploit) · → /_next/server	Élevée	Élevé · 72
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /_next/server UA Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007;… Émulateur HTTP WAF 58 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /_next/server TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8005 Chemin / cible /_next/server Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 72 Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /_next/server HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:8005 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; Andr Requête brute (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:8005 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safa Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "1978af5307537775fab4b66b0f1439319be37ce1", "http_host_hash": "7bfcd12b5dbd455ba71259931b26992d0bd516d8", "http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 996, "payload_entropy": 5.6787485205497426, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8005, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4.1, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 72, "tag_count": 13, "anomaly_count": 0, "campaign_key": "035b18e6307d46f16ddf1dfe523fde616b5c10bd", "event_fingerprint": "55ef122b91d15a9e9693c8e8b40f81e5d7db351b", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "7967be4fa492cfad4b86b41e3ae090e9", "payload_hash": "7c64124251009de5401d75833f2f91bc", "path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056" }, "target_context": { "dst_port": 8005, "service": "http", "service_name": "http", "risk_score": 72 }, "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr", "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safa", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr", "evidence": { "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safa", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "26d7ef67e4ec705c266c5619a761c79528486843", "protocol_details": { "http_method": "POST", "http_path": "\/_next\/server", "request_line": "POST \/_next\/server HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026", "port": 8005, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr", "attack_vector": "http smuggling probe \u00b7 via HTTP:8005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server", "target_port_label": "8005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 72, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8005, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/_next\/server", "request_line": "POST \/_next\/server HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026", "port": 8005, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:8005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server", "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr", "target_port_label": "8005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8005" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti", "net_web_probe" ] }
16/07/2026 21:01:38 UTC	TCP	8005 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:8005 · (tentative d'exploit) · → /app	Élevée	Élevé · 72
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /app UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l… Émulateur HTTP WAF 52 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /app TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8005 Chemin / cible /app Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 72 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /app HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 Payload (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:8005 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K Requête brute (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:8005 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-Action Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e", "http_host_hash": "7bfcd12b5dbd455ba71259931b26992d0bd516d8", "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 949, "payload_entropy": 5.649562374156473, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8005, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4.1, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 72, "tag_count": 12, "anomaly_count": 0, "campaign_key": "6dd331160e0bddf6a513973b1d12f2e01f5f8f88", "event_fingerprint": "5307c75f6521047860c74b7cfeab59a860cc35af", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966", "payload_hash": "e00126c6db229359f2b9bab3c9c9efd0", "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe" }, "target_context": { "dst_port": 8005, "service": "http", "service_name": "http", "risk_score": 72 }, "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K", "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K", "evidence": { "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "db2cd61ae833cce006158d22056807d3b7b2cf0e", "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "port": 8005, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K", "attack_vector": "http smuggling probe \u00b7 via HTTP:8005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "target_port_label": "8005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 72, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8005, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "port": 8005, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:8005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K", "target_port_label": "8005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8005" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti", "net_web_probe" ] }
16/07/2026 21:01:38 UTC	TCP	8005 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:8005 · (tentative d'exploit) · → /api/route	Élevée	Élevé · 72
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /api/route UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 62 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /api/route TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8005 Chemin / cible /api/route Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 72 Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api/route HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:8005 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10. Requête brute (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:8005 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Actio Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533", "http_host_hash": "7bfcd12b5dbd455ba71259931b26992d0bd516d8", "http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 943, "payload_entropy": 5.659150710141214, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8005, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4.1, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 72, "tag_count": 16, "anomaly_count": 0, "campaign_key": "4e58a0dc188cda2e9732c32b4ca5dfa38933fcc6", "event_fingerprint": "9f90a80fbf92bc06648891f2462494fd383ee232", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3", "payload_hash": "f550aa8ec662eb67a5ce8a5533a33fe8", "path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32" }, "target_context": { "dst_port": 8005, "service": "http", "service_name": "http", "risk_score": 72 }, "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.", "method": "POST", "path": "\/api\/route", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api\/route HTTP\/1.1", "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.", "evidence": { "method": "POST", "path": "\/api\/route", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api\/route HTTP\/1.1", "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c81f366ac7fe0e7e20e566e89db7c9d99b3b73d8", "protocol_details": { "http_method": "POST", "http_path": "\/api\/route", "request_line": "POST \/api\/route HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 8005, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.", "attack_vector": "http smuggling probe \u00b7 via HTTP:8005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route", "target_port_label": "8005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 72, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8005, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/api\/route", "request_line": "POST \/api\/route HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 8005, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:8005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route", "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.", "target_port_label": "8005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8005" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_api_route_probe", "http_contenttype_attack_surface", "http_probe_api", "http_prototype_pollution", "http_ssti", "net_web_probe" ] }
16/07/2026 21:01:37 UTC	TCP	8005 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:8005 · (tentative d'exploit) · → /api	Élevée	Élevé · 72
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /api UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 56 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /api TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8005 Chemin / cible /api Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 72 Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:8005 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac Requête brute (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:8005 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Actio Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a", "http_host_hash": "7bfcd12b5dbd455ba71259931b26992d0bd516d8", "http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 943, "payload_entropy": 5.652225249936106, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8005, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4.1, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 72, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a448a8ebff885d4b2b211d8e0a036880f6528fd1", "event_fingerprint": "dfe9f8820ce8189ad3ee7fee8e0c517173dd1ef7", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de", "payload_hash": "c6dceefea6ac4c2b07178a1475509c3b", "path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221" }, "target_context": { "dst_port": 8005, "service": "http", "service_name": "http", "risk_score": 72 }, "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "evidence": { "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "eaaf261ba61a0b6e6e886d73b151ca603852f6b3", "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 8005, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "attack_vector": "http smuggling probe \u00b7 via HTTP:8005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "target_port_label": "8005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 72, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8005, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 8005, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:8005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac", "target_port_label": "8005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8005" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_contenttype_attack_surface", "http_probe_api", "http_prototype_pollution", "http_ssti", "net_web_probe" ] }
16/07/2026 21:01:36 UTC	TCP	8005 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:8005 · (tentative d'exploit) · → /_next	Élevée	Élevé · 72
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /_next UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 52 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /_next TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8005 Chemin / cible /_next Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 72 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /_next HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:8005 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; W Requête brute (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:8005 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, deflate Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858", "http_host_hash": "7bfcd12b5dbd455ba71259931b26992d0bd516d8", "http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 947, "payload_entropy": 5.654902244252276, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8005, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4.1, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 72, "tag_count": 12, "anomaly_count": 0, "campaign_key": "6dd331160e0bddf6a513973b1d12f2e01f5f8f88", "event_fingerprint": "4f1e74f0e2f92f9d59b8521d71839021ad8814bd", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee", "payload_hash": "769a5b5506bf1315f44ee9d35d970a23", "path_pattern_hash": "bfd33612e3863357684bd23d10455a76" }, "target_context": { "dst_port": 8005, "service": "http", "service_name": "http", "risk_score": 72 }, "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W", "method": "POST", "path": "\/_next", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next HTTP\/1.1", "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\n", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W", "evidence": { "method": "POST", "path": "\/_next", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next HTTP\/1.1", "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\n", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "82d389cf51f900653c3f67031746763b1d4f648b", "protocol_details": { "http_method": "POST", "http_path": "\/_next", "request_line": "POST \/_next HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026", "port": 8005, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W", "attack_vector": "http smuggling probe \u00b7 via HTTP:8005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next", "target_port_label": "8005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 72, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8005, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/_next", "request_line": "POST \/_next HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026", "port": 8005, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:8005 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next", "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W", "target_port_label": "8005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8005" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti", "net_web_probe" ] }
16/07/2026 21:01:35 UTC	TCP	8005 · HTTP ALT 8005	http-alt-8005	http-alt-8005 http-alt-8005 · via HTTP ALT 8005:8005 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur HTTP-ALT-8005 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8005 Chemin / cible — Service HTTP ALT 8005 Pourquoi cette classification : Type « http-alt-8005 » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Alsycon B.V.", "service": "http-alt-8005", "app_proto": "http-alt-8005", "asn": 49870, "country": "SC", "dst_port": 8005, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.1, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "d9af369bde4e2828665e2d4e9860ebc242ac85ed", "event_fingerprint": "701e9661ceed5a960b420218a0913f7296688bbc", "classification_reason": "Type \u00ab http-alt-8005 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "http-alt-8005", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "1447265d540bf94fc553db8c676a07e1" }, "target_context": { "dst_port": 8005, "service": "http-alt-8005", "service_name": "http-alt-8005", "risk_score": 0 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ef3d53a2a3a411f37ee5257e9cf6963f6cb147cc", "protocol_details": { "port": 8005, "service": "http-alt-8005", "service_label_fr": "HTTP ALT 8005" }, "attack_vector": "http-alt-8005 \u00b7 via HTTP ALT 8005:8005 \u00b7 (sonde \/ probe)", "target_port_label": "8005 \u00b7 HTTP ALT 8005", "emulator_service": "http-alt-8005", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab http-alt-8005 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab http-alt-8005 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "http-alt-8005", "service_label_fr": "HTTP ALT 8005", "dst_port": 8005, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http-alt-8005", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 8005, "service": "http-alt-8005", "service_label_fr": "HTTP ALT 8005" }, "attack_vector": "http-alt-8005 \u00b7 via HTTP ALT 8005:8005 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "8005 \u00b7 HTTP ALT 8005", "emulator_service": "http-alt-8005", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http_alt_8005", "service_banner": "honeypot-http-alt-8005", "service_os": "linux", "dst_port": "8005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
16/07/2026 21:01:35 UTC	TCP	8005 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:8005 · (tentative d'exploit)	Élevée	Élevé · 72
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100… Émulateur HTTP WAF 55 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8005 Chemin / cible / Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 72 Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:8005 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:8005 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: poop1234 Cont Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "fac64969f9eca34262c56352be2d62dd2d22b1a0", "http_host_hash": "7bfcd12b5dbd455ba71259931b26992d0bd516d8", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 903, "payload_entropy": 5.633434360301364, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8005, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4.1, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 72, "tag_count": 13, "anomaly_count": 0, "campaign_key": "80b5fcb7933523f151c1488fb5713bc3f05c8e6b", "event_fingerprint": "1481542461ea81f594f7670822f75aa73bc92829", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9f10b48170735feac18b44fa385fef37", "payload_hash": "c321dabe4f97f5652934dc94baea2f89", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8005, "service": "http", "service_name": "http", "risk_score": 72 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nCont", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nCont", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "23e4cfd345772df2109289f1298d465ece95f420", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.", "port": 8005, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;", "attack_vector": "http smuggling probe \u00b7 via HTTP:8005 \u00b7 (tentative d'exploit)", "target_port_label": "8005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 72, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 72, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8005, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.", "port": 8005, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:8005 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8005\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;", "target_port_label": "8005 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8005" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti", "net_web_probe" ] }
16/07/2026 20:39:55 UTC	TCP	9901 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:9901 · (tentative d'exploit) · → /_next/server	Élevée	Élevé · 73
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /_next/server UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 58 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /_next/server TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 9901 Chemin / cible /_next/server Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 73 Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /_next/server HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:9901 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Requête brute (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:9901 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate N Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a", "http_host_hash": "9a0d91d976f8736fe81fe3d8c16dfb97e2f2ee63", "http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 953, "payload_entropy": 5.642979882778687, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 9901, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4.9, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 73, "tag_count": 12, "anomaly_count": 0, "campaign_key": "ba9f2d3fe29c34fc92e5683f3b1c4e03901cf920", "event_fingerprint": "3dde3ac5d445241b11c4f91d55178f37cab1c814", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de", "payload_hash": "2345e168af565cf11b2ecf2c465a2fe5", "path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056" }, "target_context": { "dst_port": 9901, "service": "http", "service_name": "http", "risk_score": 73 }, "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; ", "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;", "evidence": { "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2ad00669b46d0e9f2b494ff692de068c81547b0c", "protocol_details": { "http_method": "POST", "http_path": "\/_next\/server", "request_line": "POST \/_next\/server HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 9901, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;", "attack_vector": "http smuggling probe \u00b7 via HTTP:9901 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server", "target_port_label": "9901 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 73, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9901, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/_next\/server", "request_line": "POST \/_next\/server HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 9901, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:9901 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server", "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;", "target_port_label": "9901 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9901" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:9901" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti" ] }
16/07/2026 20:39:55 UTC	TCP	9901 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:9901 · (tentative d'exploit) · → /app	Élevée	Élevé · 73
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /app UA Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) Appl… Émulateur HTTP WAF 52 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /app TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 9901 Chemin / cible /app Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 73 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /app HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 Payload (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:9901 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AF Requête brute (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:9901 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36 Accept-E Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95", "http_host_hash": "9a0d91d976f8736fe81fe3d8c16dfb97e2f2ee63", "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 978, "payload_entropy": 5.672256161981216, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 9901, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4.9, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 73, "tag_count": 11, "anomaly_count": 0, "campaign_key": "7bfd6861d3c0df6cda571d6fe947a451341f4ca1", "event_fingerprint": "c7576839964b8ef3ca621c776d503794681c16ab", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "c772734c6eb2978096c283068906aec3", "payload_hash": "59c462b26c5099fc173efdebacee5485", "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe" }, "target_context": { "dst_port": 9901, "service": "http", "service_name": "http", "risk_score": 73 }, "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF", "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-E", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF", "evidence": { "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-E", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "999e9658e2105871872e9b3b72c971d8e54e4df3", "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026", "port": 9901, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF", "attack_vector": "http smuggling probe \u00b7 via HTTP:9901 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "target_port_label": "9901 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 73, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9901, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026", "port": 9901, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:9901 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF", "target_port_label": "9901 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9901" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:9901" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti" ] }
16/07/2026 20:39:55 UTC	TCP	9901 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:9901 · (tentative d'exploit) · → /api/route	Élevée	Élevé · 73
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /api/route UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 62 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /api/route TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 9901 Chemin / cible /api/route Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 73 Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api/route HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:9901 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Int Requête brute (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:9901 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a", "http_host_hash": "9a0d91d976f8736fe81fe3d8c16dfb97e2f2ee63", "http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 949, "payload_entropy": 5.641668921629417, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 9901, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4.9, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 73, "tag_count": 15, "anomaly_count": 0, "campaign_key": "d3c8382e8e2711f7289e9df385ebdcb2fe1c3869", "event_fingerprint": "5b98f1f940ea24e6ebcb7d97c02589ef555292fb", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de", "payload_hash": "aac3e04305cd7475a5aa685c5a77d202", "path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32" }, "target_context": { "dst_port": 9901, "service": "http", "service_name": "http", "risk_score": 73 }, "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int", "method": "POST", "path": "\/api\/route", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api\/route HTTP\/1.1", "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int", "evidence": { "method": "POST", "path": "\/api\/route", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api\/route HTTP\/1.1", "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "69cd173c950015138e841755b344218d1bea9c1c", "protocol_details": { "http_method": "POST", "http_path": "\/api\/route", "request_line": "POST \/api\/route HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 9901, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int", "attack_vector": "http smuggling probe \u00b7 via HTTP:9901 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route", "target_port_label": "9901 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 73, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9901, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/api\/route", "request_line": "POST \/api\/route HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 9901, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:9901 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route", "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int", "target_port_label": "9901 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9901" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:9901" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_api_route_probe", "http_contenttype_attack_surface", "http_probe_api", "http_prototype_pollution", "http_ssti" ] }
16/07/2026 20:39:54 UTC	TCP	9901 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:9901 · (tentative d'exploit) · → /api	Élevée	Élevé · 73
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /api UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb… Émulateur HTTP WAF 56 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /api TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 9901 Chemin / cible /api Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 73 Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api HTTP/1.1` User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:9901 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone O Requête brute (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:9901 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-Encoding: Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe", "http_host_hash": "9a0d91d976f8736fe81fe3d8c16dfb97e2f2ee63", "http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 968, "payload_entropy": 5.657984452093404, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 9901, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4.9, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 73, "tag_count": 13, "anomaly_count": 0, "campaign_key": "45dccbaeae1df281b026b3716e00f82dc8c48117", "event_fingerprint": "296800d020f0c7a98b58230383b3cb5f0bbbade8", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b", "payload_hash": "e899729f5ef172874b1cbe1cdeb02fed", "path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221" }, "target_context": { "dst_port": 9901, "service": "http", "service_name": "http", "risk_score": 73 }, "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O", "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: ", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O", "evidence": { "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: ", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9ca959d072c8b72f8276dd48d1e51633c60cd07e", "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026", "port": 9901, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O", "attack_vector": "http smuggling probe \u00b7 via HTTP:9901 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "target_port_label": "9901 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 73, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9901, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026", "port": 9901, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:9901 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O", "target_port_label": "9901 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9901" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:9901" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_contenttype_attack_surface", "http_probe_api", "http_prototype_pollution", "http_ssti" ] }
16/07/2026 20:39:53 UTC	TCP	9901 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:9901 · (tentative d'exploit) · → /_next	Élevée	Élevé · 73
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /_next UA Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/… Émulateur HTTP WAF 52 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /_next TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 9901 Chemin / cible /_next Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 73 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /_next HTTP/1.1` User-Agent Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:9901 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android Requête brute (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:9901 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gzip, Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea", "http_host_hash": "9a0d91d976f8736fe81fe3d8c16dfb97e2f2ee63", "http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 962, "payload_entropy": 5.682460101275393, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 9901, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4.9, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 73, "tag_count": 11, "anomaly_count": 0, "campaign_key": "7bfd6861d3c0df6cda571d6fe947a451341f4ca1", "event_fingerprint": "1dee67cffb62070550cd1b550f54141d0e066677", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "6c8160595869adea51d6742918f57fdf", "payload_hash": "a795ddd866af6c6787bf374dc97aae87", "path_pattern_hash": "bfd33612e3863357684bd23d10455a76" }, "target_context": { "dst_port": 9901, "service": "http", "service_name": "http", "risk_score": 73 }, "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android ", "method": "POST", "path": "\/_next", "user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next HTTP\/1.1", "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, ", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android", "evidence": { "method": "POST", "path": "\/_next", "user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next HTTP\/1.1", "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, ", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "47eeae19625e63ddbf41fa205afca6cb8d4ac2a3", "protocol_details": { "http_method": "POST", "http_path": "\/_next", "request_line": "POST \/_next HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026", "port": 9901, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android", "attack_vector": "http smuggling probe \u00b7 via HTTP:9901 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next", "target_port_label": "9901 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 73, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9901, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/_next", "request_line": "POST \/_next HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026", "port": 9901, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:9901 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next", "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android", "target_port_label": "9901 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9901" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:9901" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti" ] }
16/07/2026 20:39:52 UTC	TCP	9901	—	Sonde port Sonde port · port 9901 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9901 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Alsycon B.V.", "service": null, "app_proto": null, "asn": 49870, "country": "SC", "dst_port": 9901, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.9, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "10a09b5c8a773d85b0f80a12254055835804b6f8", "event_fingerprint": "82af39390e28625337dd38090a4d60673ac01fa3", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 9901, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e779397e22e3f1a84c7b28febe53ab714abe4e0f", "protocol_details": { "port": 9901 }, "attack_vector": "Sonde port \u00b7 port 9901 \u00b7 (sonde \/ probe)", "target_port_label": "9901", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 9901, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 9901 }, "attack_vector": "Sonde port \u00b7 port 9901 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "9901", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9901" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
16/07/2026 20:39:52 UTC	TCP	9901 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:9901 · (tentative d'exploit)	Élevée	Élevé · 73
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 55 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 9901 Chemin / cible / Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 73 Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:9901 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:9901 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a", "http_host_hash": "9a0d91d976f8736fe81fe3d8c16dfb97e2f2ee63", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 940, "payload_entropy": 5.652539673180041, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 9901, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4.9, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 73, "tag_count": 12, "anomaly_count": 0, "campaign_key": "3494ec414a062804192dee0c7f199258685f185e", "event_fingerprint": "9bd018a994057f1cc9573ccc270d0e951c015a49", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de", "payload_hash": "50bceca7a4083a99166412e48d7a322c", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 9901, "service": "http", "service_name": "http", "risk_score": 73 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: ", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: ", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "509f0d458c495db15c3642dc28f1027ba0dec23e", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 9901, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "attack_vector": "http smuggling probe \u00b7 via HTTP:9901 \u00b7 (tentative d'exploit)", "target_port_label": "9901 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 73, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 9901, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 9901, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:9901 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9901\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS", "target_port_label": "9901 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "9901" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:9901" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti" ] }
16/07/2026 20:24:07 UTC	TCP	3020 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3020 · (tentative d'exploit) · → /_next/server	Élevée	Élevé · 73
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /_next/server UA Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007;… Émulateur HTTP WAF 58 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /_next/server TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3020 Chemin / cible /_next/server Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 73 Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /_next/server HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:3020 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Andr Requête brute (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:3020 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safa Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "1978af5307537775fab4b66b0f1439319be37ce1", "http_host_hash": "b404652f9a7a451dc3490eefbd660e2c3733ba94", "http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 997, "payload_entropy": 5.66306520188057, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 3020, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 5.1, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 73, "tag_count": 12, "anomaly_count": 0, "campaign_key": "938489ca79c3f0629b087ac7a9beff30f34dc27b", "event_fingerprint": "7a877bfb1f4f1fb89f4ef8b38fade88141b118b2", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "7967be4fa492cfad4b86b41e3ae090e9", "payload_hash": "03e48f8c1635f19d5d3e0e2d4afe6cbe", "path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056" }, "target_context": { "dst_port": 3020, "service": "http", "service_name": "http", "risk_score": 73 }, "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr", "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safa", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr", "evidence": { "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safa", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2ce4bcd638ebbbbaa8e76b17ad354d5f91cd5d3d", "protocol_details": { "http_method": "POST", "http_path": "\/_next\/server", "request_line": "POST \/_next\/server HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026", "port": 3020, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr", "attack_vector": "http smuggling probe \u00b7 via HTTP:3020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server", "target_port_label": "3020 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 73, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3020, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/_next\/server", "request_line": "POST \/_next\/server HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026", "port": 3020, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server", "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr", "target_port_label": "3020 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:3020" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti" ] }
16/07/2026 20:24:07 UTC	TCP	3020 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3020 · (tentative d'exploit) · → /app	Élevée	Élevé · 73
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /app UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like… Émulateur HTTP WAF 52 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /app TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3020 Chemin / cible /app Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 73 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /app HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 Payload (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3020 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) A Requête brute (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:3020 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-R Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd", "http_host_hash": "b404652f9a7a451dc3490eefbd660e2c3733ba94", "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 927, "payload_entropy": 5.640041932811891, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 3020, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 5.1, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 73, "tag_count": 11, "anomaly_count": 0, "campaign_key": "242a2de039f571346e4b3ba06cdb851310fb49af", "event_fingerprint": "1bb173f88cf81a8df656f280a7e78a4d6d181551", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "72d43eb808798db218d063798749cc39", "payload_hash": "710f416942a31fadca35466bbbee04fe", "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe" }, "target_context": { "dst_port": 3020, "service": "http", "service_name": "http", "risk_score": 73 }, "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A", "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-R", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A", "evidence": { "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-R", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d89b6ca39cf40d88a87db5c4c98370a2d077c437", "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 3020, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A", "attack_vector": "http smuggling probe \u00b7 via HTTP:3020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "target_port_label": "3020 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 73, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3020, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 3020, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A", "target_port_label": "3020 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:3020" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti" ] }
16/07/2026 20:24:07 UTC	TCP	3020 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3020 · (tentative d'exploit) · → /api/route	Élevée	Élevé · 73
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /api/route UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH… Émulateur HTTP WAF 62 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /api/route TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3020 Chemin / cible /api/route Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 73 Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api/route HTTP/1.1` User-Agent Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:3020 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_ Requête brute (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:3020 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b", "http_host_hash": "b404652f9a7a451dc3490eefbd660e2c3733ba94", "http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 949, "payload_entropy": 5.6551808241450825, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 3020, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 5.1, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 73, "tag_count": 15, "anomaly_count": 0, "campaign_key": "8c99c9bf56854c8fff6f37440f14d083a7c75393", "event_fingerprint": "44b7e2628fc804e3fb4b93bf8f51790f166e7e97", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "5ea6889a59d080298a42c0e1b4758211", "payload_hash": "25858d9113423a380fd88cf258c62a8c", "path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32" }, "target_context": { "dst_port": 3020, "service": "http", "service_name": "http", "risk_score": 73 }, "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_", "method": "POST", "path": "\/api\/route", "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api\/route HTTP\/1.1", "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_", "evidence": { "method": "POST", "path": "\/api\/route", "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api\/route HTTP\/1.1", "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e00a3914a5f1cdc8961a18511babdd4c9cf25368", "protocol_details": { "http_method": "POST", "http_path": "\/api\/route", "request_line": "POST \/api\/route HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 3020, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_", "attack_vector": "http smuggling probe \u00b7 via HTTP:3020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route", "target_port_label": "3020 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 73, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3020, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/api\/route", "request_line": "POST \/api\/route HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 3020, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route", "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_", "target_port_label": "3020 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:3020" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_api_route_probe", "http_contenttype_attack_surface", "http_probe_api", "http_prototype_pollution", "http_ssti" ] }
16/07/2026 20:24:06 UTC	TCP	3020 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3020 · (tentative d'exploit) · → /api	Élevée	Élevé · 73
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /api UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l… Émulateur HTTP WAF 56 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /api TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3020 Chemin / cible /api Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 73 Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:3020 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K Requête brute (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:3020 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-Action Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e", "http_host_hash": "b404652f9a7a451dc3490eefbd660e2c3733ba94", "http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 949, "payload_entropy": 5.6597997987657225, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 3020, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 5.1, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 73, "tag_count": 13, "anomaly_count": 0, "campaign_key": "6a69cc24e213f153c67086d75baac2044ea054f0", "event_fingerprint": "ead93c63b3bb75a58567b252d1c4a7b23cedf870", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966", "payload_hash": "9115fc6ff540fd834ac86135fc2cfff2", "path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221" }, "target_context": { "dst_port": 3020, "service": "http", "service_name": "http", "risk_score": 73 }, "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K", "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K", "evidence": { "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "76a45ece1251dbbe276b253ac3d686ceaf61c6db", "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "port": 3020, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K", "attack_vector": "http smuggling probe \u00b7 via HTTP:3020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "target_port_label": "3020 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 73, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3020, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "port": 3020, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K", "target_port_label": "3020 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:3020" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_contenttype_attack_surface", "http_probe_api", "http_prototype_pollution", "http_ssti" ] }
16/07/2026 20:24:05 UTC	TCP	3020 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3020 · (tentative d'exploit) · → /_next	Élevée	Élevé · 73
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /_next UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH… Émulateur HTTP WAF 52 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /_next TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3020 Chemin / cible /_next Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 73 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /_next HTTP/1.1` User-Agent Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:3020 Content-Length: 507 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 1 Requête brute (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:3020 Content-Length: 507 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b", "http_host_hash": "b404652f9a7a451dc3490eefbd660e2c3733ba94", "http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 924, "payload_entropy": 5.645431883664682, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 3020, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 5.1, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 73, "tag_count": 11, "anomaly_count": 0, "campaign_key": "242a2de039f571346e4b3ba06cdb851310fb49af", "event_fingerprint": "09b6ab81acf11b2e19baf2052521a54c3cbf7db5", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "5ea6889a59d080298a42c0e1b4758211", "payload_hash": "51d4bc7a4c90a5ca9e4073a1e72e8e27", "path_pattern_hash": "bfd33612e3863357684bd23d10455a76" }, "target_context": { "dst_port": 3020, "service": "http", "service_name": "http", "risk_score": 73 }, "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1", "method": "POST", "path": "\/_next", "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next HTTP\/1.1", "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1", "evidence": { "method": "POST", "path": "\/_next", "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next HTTP\/1.1", "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "975cd6ebab4f479c3119961614b1aa81c23b4423", "protocol_details": { "http_method": "POST", "http_path": "\/_next", "request_line": "POST \/_next HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 3020, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1", "attack_vector": "http smuggling probe \u00b7 via HTTP:3020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next", "target_port_label": "3020 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 73, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3020, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/_next", "request_line": "POST \/_next HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 3020, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3020 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next", "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1", "target_port_label": "3020 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:3020" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti" ] }
16/07/2026 20:24:04 UTC	TCP	3020	—	Sonde port Sonde port · port 3020 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3020 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Alsycon B.V.", "service": null, "app_proto": null, "asn": 49870, "country": "SC", "dst_port": 3020, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "cb7170d5dd4039210e32bf0e88f4f824e92c7b6b", "event_fingerprint": "4f5701d8744dd254a057267269961ea32fcc24da", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 3020, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e12c23439fada4691db2790b013546148bd104e6", "protocol_details": { "port": 3020 }, "attack_vector": "Sonde port \u00b7 port 3020 \u00b7 (sonde \/ probe)", "target_port_label": "3020", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 3020, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 3020 }, "attack_vector": "Sonde port \u00b7 port 3020 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "3020", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "3020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
16/07/2026 20:24:04 UTC	TCP	3020 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3020 · (tentative d'exploit)	Élevée	Élevé · 73
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l… Émulateur HTTP WAF 55 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3020 Chemin / cible / Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 73 Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3020 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) A Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3020 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e", "http_host_hash": "b404652f9a7a451dc3490eefbd660e2c3733ba94", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 940, "payload_entropy": 5.6232860238753855, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 3020, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 5.1, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 73, "tag_count": 12, "anomaly_count": 0, "campaign_key": "cae5a2d77383b3266263256c5241d2ece31cc77b", "event_fingerprint": "f51f83a54454bab02a6d996c85f736bd6cef66c8", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966", "payload_hash": "7d47330c29fc86c0d8d66260edadd108", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3020, "service": "http", "service_name": "http", "risk_score": 73 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a989323495aa34cd1d2ed91a4e58862a48ed581e", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "port": 3020, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A", "attack_vector": "http smuggling probe \u00b7 via HTTP:3020 \u00b7 (tentative d'exploit)", "target_port_label": "3020 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 73, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3020, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "port": 3020, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3020 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3020\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A", "target_port_label": "3020 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:3020" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti" ] }
16/07/2026 20:10:09 UTC	TCP	7575 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:7575 · (tentative d'exploit) · → /app	Élevée	Élevé · 73
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /app UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH… Émulateur HTTP WAF 52 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /app TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 7575 Chemin / cible /app Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 73 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /app HTTP/1.1` User-Agent Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 Payload (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:7575 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 145 Requête brute (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:7575 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b", "http_host_hash": "4906f22e757962b4f9d1f873fa79ad166e47dfb9", "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 936, "payload_entropy": 5.658412952299932, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 7575, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 73, "tag_count": 11, "anomaly_count": 0, "campaign_key": "fb6df6976c674be9e5361ffae73cc6378d1a3906", "event_fingerprint": "9130a1cf6da0e184fce34130f8e0e60630618d76", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "5ea6889a59d080298a42c0e1b4758211", "payload_hash": "fa72b4ca984cd634072f1232c3583b94", "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe" }, "target_context": { "dst_port": 7575, "service": "http", "service_name": "http", "risk_score": 73 }, "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145", "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145", "evidence": { "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "88a667f924a360e0489ebe5813522dc48a0e8944", "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 7575, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145", "attack_vector": "http smuggling probe \u00b7 via HTTP:7575 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "target_port_label": "7575 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 73, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7575, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 7575, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:7575 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145", "target_port_label": "7575 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7575" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:7575" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti" ] }
16/07/2026 20:10:09 UTC	TCP	7575 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:7575 · (tentative d'exploit) · → /api/route	Élevée	Élevé · 73
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /api/route UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 62 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /api/route TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 7575 Chemin / cible /api/route Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 73 Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api/route HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:7575 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Int Requête brute (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:7575 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a", "http_host_hash": "4906f22e757962b4f9d1f873fa79ad166e47dfb9", "http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 950, "payload_entropy": 5.646902188037061, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 7575, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 73, "tag_count": 15, "anomaly_count": 0, "campaign_key": "d3c3e5dfc5dd88cc4c8fa00c7da22e2f7d1a2663", "event_fingerprint": "be87c803768e960cfd2eefa7cbe4a4f1216c1cff", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de", "payload_hash": "55c883aae3e44a3550b3ef6907ce6406", "path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32" }, "target_context": { "dst_port": 7575, "service": "http", "service_name": "http", "risk_score": 73 }, "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int", "method": "POST", "path": "\/api\/route", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api\/route HTTP\/1.1", "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int", "evidence": { "method": "POST", "path": "\/api\/route", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api\/route HTTP\/1.1", "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "09e1908695a3ba6b253782d37f6709d9d89c3465", "protocol_details": { "http_method": "POST", "http_path": "\/api\/route", "request_line": "POST \/api\/route HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 7575, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int", "attack_vector": "http smuggling probe \u00b7 via HTTP:7575 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route", "target_port_label": "7575 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 73, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7575, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/api\/route", "request_line": "POST \/api\/route HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 7575, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:7575 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route", "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int", "target_port_label": "7575 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7575" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:7575" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_api_route_probe", "http_contenttype_attack_surface", "http_probe_api", "http_prototype_pollution", "http_ssti" ] }
16/07/2026 20:10:08 UTC	TCP	7575 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:7575 · (tentative d'exploit) · → /_next/server	Élevée	Élevé · 73
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /_next/server UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 58 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /_next/server TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 7575 Chemin / cible /_next/server Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 73 Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /_next/server HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:7575 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (Windows NT Requête brute (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:7575 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Ac Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533", "http_host_hash": "4906f22e757962b4f9d1f873fa79ad166e47dfb9", "http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 940, "payload_entropy": 5.647869853123824, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 7575, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 73, "tag_count": 12, "anomaly_count": 0, "campaign_key": "484225c89ddcee28569623c94bd93022e6d643a3", "event_fingerprint": "21cd373dcf99bcee64eece67414eb0e47e1818a6", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3", "payload_hash": "85cac456ed9a6252ae730b6981ee8fbf", "path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056" }, "target_context": { "dst_port": 7575, "service": "http", "service_name": "http", "risk_score": 73 }, "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT ", "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Ac", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT", "evidence": { "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Ac", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "60622a9984a837179ae2a11e1942548274244be2", "protocol_details": { "http_method": "POST", "http_path": "\/_next\/server", "request_line": "POST \/_next\/server HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 7575, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT", "attack_vector": "http smuggling probe \u00b7 via HTTP:7575 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server", "target_port_label": "7575 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 73, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7575, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/_next\/server", "request_line": "POST \/_next\/server HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 7575, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:7575 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server", "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT", "target_port_label": "7575 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7575" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:7575" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti" ] }
16/07/2026 20:10:07 UTC	TCP	7575 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:7575 · (tentative d'exploit) · → /_next	Élevée	Élevé · 73
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /_next UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l… Émulateur HTTP WAF 52 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /_next TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 7575 Chemin / cible /_next Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 73 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /_next HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:7575 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; Requête brute (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:7575 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-Acti Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e", "http_host_hash": "4906f22e757962b4f9d1f873fa79ad166e47dfb9", "http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 945, "payload_entropy": 5.655459074522786, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 7575, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 73, "tag_count": 11, "anomaly_count": 0, "campaign_key": "fb6df6976c674be9e5361ffae73cc6378d1a3906", "event_fingerprint": "4f60560e26c210864ec4ec6b512ce2123c8957f1", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966", "payload_hash": "3ffc427871be37f9037d0bc10bfe50ea", "path_pattern_hash": "bfd33612e3863357684bd23d10455a76" }, "target_context": { "dst_port": 7575, "service": "http", "service_name": "http", "risk_score": 73 }, "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;", "method": "POST", "path": "\/_next", "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next HTTP\/1.1", "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Acti", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;", "evidence": { "method": "POST", "path": "\/_next", "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next HTTP\/1.1", "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Acti", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c77b1d32ffb9dd14db57276c907771ccb4ab5907", "protocol_details": { "http_method": "POST", "http_path": "\/_next", "request_line": "POST \/_next HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "port": 7575, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;", "attack_vector": "http smuggling probe \u00b7 via HTTP:7575 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next", "target_port_label": "7575 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 73, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7575, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/_next", "request_line": "POST \/_next HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "port": 7575, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:7575 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next", "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;", "target_port_label": "7575 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7575" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:7575" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti" ] }
16/07/2026 20:10:07 UTC	TCP	7575 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:7575 · (tentative d'exploit) · → /api	Élevée	Élevé · 73
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /api UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l… Émulateur HTTP WAF 56 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /api TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 7575 Chemin / cible /api Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 73 Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:7575 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K Requête brute (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:7575 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-Action Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e", "http_host_hash": "4906f22e757962b4f9d1f873fa79ad166e47dfb9", "http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 943, "payload_entropy": 5.651653623167859, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 7575, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 73, "tag_count": 13, "anomaly_count": 0, "campaign_key": "14f39dd2c170be0f8a987917ab3b365709673f78", "event_fingerprint": "e5077c0c974bee5e8ac535258dede2bf6a2d3e42", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966", "payload_hash": "a0354b212ba62d10f94bf3705a81edcd", "path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221" }, "target_context": { "dst_port": 7575, "service": "http", "service_name": "http", "risk_score": 73 }, "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K", "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K", "evidence": { "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5173a9908706fbb92e4694aff6b19621868ab656", "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "port": 7575, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K", "attack_vector": "http smuggling probe \u00b7 via HTTP:7575 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "target_port_label": "7575 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 73, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7575, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "port": 7575, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:7575 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K", "target_port_label": "7575 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7575" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:7575" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_contenttype_attack_surface", "http_probe_api", "http_prototype_pollution", "http_ssti" ] }
16/07/2026 20:10:06 UTC	TCP	7575	—	Sonde port Sonde port · port 7575 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7575 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Alsycon B.V.", "service": null, "app_proto": null, "asn": 49870, "country": "SC", "dst_port": 7575, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "849a08f4c7252401b8db88f183c6ca90a902e706", "event_fingerprint": "acf60a6ac3a98733990a626a222654d492c2a40b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 7575, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "168c441d8ca7e8c1978b347ab6a77a9e02bf5228", "protocol_details": { "port": 7575 }, "attack_vector": "Sonde port \u00b7 port 7575 \u00b7 (sonde \/ probe)", "target_port_label": "7575", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 7575, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 7575 }, "attack_vector": "Sonde port \u00b7 port 7575 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "7575", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "7575" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
16/07/2026 20:10:06 UTC	TCP	7575 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:7575 · (tentative d'exploit)	Élevée	Élevé · 73
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/… Émulateur HTTP WAF 55 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 7575 Chemin / cible / Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 73 Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:7575 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2 Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:7575 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gzip, defla Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea", "http_host_hash": "4906f22e757962b4f9d1f873fa79ad166e47dfb9", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 958, "payload_entropy": 5.681919432854979, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 7575, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 4.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 73, "tag_count": 12, "anomaly_count": 0, "campaign_key": "34c1c29fcb2fa3db774dd3228b14c524b5bf7acd", "event_fingerprint": "3285192320c804dfd789782f396ee237f293c8d4", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "6c8160595869adea51d6742918f57fdf", "payload_hash": "9c04f1f998cb1adf4f976e5d117187b1", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 7575, "service": "http", "service_name": "http", "risk_score": 73 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, defla", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, defla", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0ff3a31c3f95c563a6b94468d8c6c201c242de33", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026", "port": 7575, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2", "attack_vector": "http smuggling probe \u00b7 via HTTP:7575 \u00b7 (tentative d'exploit)", "target_port_label": "7575 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 73, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 73, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7575, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026", "port": 7575, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:7575 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:7575\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2", "target_port_label": "7575 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7575" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:7575" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti" ] }
16/07/2026 19:50:13 UTC	TCP	8084 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:8084 · (tentative d'exploit) · → /_next/server	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /_next/server UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH… Émulateur HTTP WAF 58 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /_next/server TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8084 Chemin / cible /_next/server Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /_next/server HTTP/1.1` User-Agent Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:8084 Content-Length: 507 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x Requête brute (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:8084 Content-Length: 507 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Act Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b", "http_host_hash": "52139ff216422f6e734a2f69155b92f0ec67e9f8", "http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 931, "payload_entropy": 5.623428051964215, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8084, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 13, "anomaly_count": 0, "campaign_key": "31c5f2bb4b572f84fa92a33c5ac7b3b17b72e5c8", "event_fingerprint": "59ea15e0a88dd0c7ca70e31f058c7af6bb1a86f4", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "5ea6889a59d080298a42c0e1b4758211", "payload_hash": "cac8836cad7d13033c3bcf3c76e9a85f", "path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056" }, "target_context": { "dst_port": 8084, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x", "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Act", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x", "evidence": { "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Act", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3435f22ba4e6f2f3fe3a9af29a78741bf593e918", "protocol_details": { "http_method": "POST", "http_path": "\/_next\/server", "request_line": "POST \/_next\/server HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 8084, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x", "attack_vector": "http smuggling probe \u00b7 via HTTP:8084 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server", "target_port_label": "8084 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8084, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/_next\/server", "request_line": "POST \/_next\/server HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 8084, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:8084 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server", "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x", "target_port_label": "8084 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8084" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8084" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti", "net_web_probe" ] }
16/07/2026 19:50:13 UTC	TCP	8084 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:8084 · (tentative d'exploit) · → /app	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /app UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH… Émulateur HTTP WAF 52 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /app TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8084 Chemin / cible /app Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /app HTTP/1.1` User-Agent Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 Payload (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:8084 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 145 Requête brute (extrait) POST /app HTTP/1.1 Host: 62.3.50.33:8084 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b", "http_host_hash": "52139ff216422f6e734a2f69155b92f0ec67e9f8", "http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 943, "payload_entropy": 5.65620234696695, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8084, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 12, "anomaly_count": 0, "campaign_key": "cf828a154cb57f7245e9e5b571abf23bd8e4b093", "event_fingerprint": "c3b05697216813ac867bae5808b3bd90499acb45", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "5ea6889a59d080298a42c0e1b4758211", "payload_hash": "892a2221253b41f8794fcae8a66c685b", "path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe" }, "target_context": { "dst_port": 8084, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145", "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145", "evidence": { "method": "POST", "path": "\/app", "user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/app HTTP\/1.1", "request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX", "payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cbdfe02b2e64c3c858ffe10e2e8788357a291761", "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 8084, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145", "attack_vector": "http smuggling probe \u00b7 via HTTP:8084 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "target_port_label": "8084 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8084, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/app", "request_line": "POST \/app HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36", "port": 8084, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:8084 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app", "evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145", "target_port_label": "8084 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8084" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8084" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti", "net_web_probe" ] }
16/07/2026 19:50:13 UTC	TCP	8084 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:8084 · (tentative d'exploit) · → /api/route	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /api/route UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 62 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /api/route TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8084 Chemin / cible /api/route Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api/route HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:8084 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10. Requête brute (extrait) POST /api/route HTTP/1.1 Host: 62.3.50.33:8084 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, defla Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858", "http_host_hash": "52139ff216422f6e734a2f69155b92f0ec67e9f8", "http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 958, "payload_entropy": 5.674682418533676, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8084, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 16, "anomaly_count": 0, "campaign_key": "28417b2555dca3146d88b416bdc754b9c91292f8", "event_fingerprint": "7049749b8e298fcab98f969f731478d26b5e3dfc", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee", "payload_hash": "de73ce1e7598591cf579a5e21ed0cd7d", "path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32" }, "target_context": { "dst_port": 8084, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.", "method": "POST", "path": "\/api\/route", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api\/route HTTP\/1.1", "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, defla", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.", "evidence": { "method": "POST", "path": "\/api\/route", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api\/route HTTP\/1.1", "request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, defla", "payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cad72d0ea911b3e8422cd1d31bdd2dad00f95b87", "protocol_details": { "http_method": "POST", "http_path": "\/api\/route", "request_line": "POST \/api\/route HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026", "port": 8084, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.", "attack_vector": "http smuggling probe \u00b7 via HTTP:8084 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route", "target_port_label": "8084 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8084, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/api\/route", "request_line": "POST \/api\/route HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026", "port": 8084, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:8084 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route", "evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.", "target_port_label": "8084 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8084" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8084" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_api_route_probe", "http_contenttype_attack_surface", "http_probe_api", "http_prototype_pollution", "http_ssti", "net_web_probe" ] }
16/07/2026 19:50:12 UTC	TCP	8084 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:8084 · (tentative d'exploit) · → /api	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /api UA Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007;… Émulateur HTTP WAF 56 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /api TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8084 Chemin / cible /api Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /api HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 k8s-api Payload (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:8084 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; S Requête brute (extrait) POST /api HTTP/1.1 Host: 62.3.50.33:8084 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "1978af5307537775fab4b66b0f1439319be37ce1", "http_host_hash": "52139ff216422f6e734a2f69155b92f0ec67e9f8", "http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 987, "payload_entropy": 5.661516593674479, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8084, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 14, "anomaly_count": 0, "campaign_key": "56b4a90f7f9580dd1b2c574424b82fc5f5a5684c", "event_fingerprint": "0fc2c7882e431629514c118ae2b61f17c0f1e4a3", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "7967be4fa492cfad4b86b41e3ae090e9", "payload_hash": "4a6c6f81a79a0a97d2ea97441257bbe3", "path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221" }, "target_context": { "dst_port": 8084, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S", "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S", "evidence": { "method": "POST", "path": "\/api", "user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "k8s-api" ], "request_line": "POST \/api HTTP\/1.1", "request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36", "payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "27e3efaa9cb5c56b5057fa808e8cd1d55815025b", "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026", "port": 8084, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S", "attack_vector": "http smuggling probe \u00b7 via HTTP:8084 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "target_port_label": "8084 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8084, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/api", "request_line": "POST \/api HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026", "port": 8084, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:8084 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api", "evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S", "target_port_label": "8084 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8084" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8084" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950600:k8s-api", "http_contenttype_attack_surface", "http_probe_api", "http_prototype_pollution", "http_ssti", "net_web_probe" ] }
16/07/2026 19:50:11 UTC	TCP	8084 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:8084 · (tentative d'exploit) · → /_next	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /_next UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb… Émulateur HTTP WAF 52 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /_next TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8084 Chemin / cible /_next Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /_next HTTP/1.1` User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:8084 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone Requête brute (extrait) POST /_next HTTP/1.1 Host: 62.3.50.33:8084 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-Encoding Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe", "http_host_hash": "52139ff216422f6e734a2f69155b92f0ec67e9f8", "http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 971, "payload_entropy": 5.678302463221022, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8084, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 12, "anomaly_count": 0, "campaign_key": "cf828a154cb57f7245e9e5b571abf23bd8e4b093", "event_fingerprint": "d5533d5060b250103a37a7f69da10a7deaf1220e", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b", "payload_hash": "54e494a0c2197b21b589ffc6508dc220", "path_pattern_hash": "bfd33612e3863357684bd23d10455a76" }, "target_context": { "dst_port": 8084, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone", "method": "POST", "path": "\/_next", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next HTTP\/1.1", "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone", "evidence": { "method": "POST", "path": "\/_next", "user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next HTTP\/1.1", "request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding", "payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1b59ef0d5fda95e121455b209faed22567e9dd12", "protocol_details": { "http_method": "POST", "http_path": "\/_next", "request_line": "POST \/_next HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026", "port": 8084, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone", "attack_vector": "http smuggling probe \u00b7 via HTTP:8084 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next", "target_port_label": "8084 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8084, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/_next", "request_line": "POST \/_next HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026", "port": 8084, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:8084 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next", "evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone", "target_port_label": "8084 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8084" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8084" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti", "net_web_probe" ] }
16/07/2026 19:50:10 UTC	TCP	8084 · HTTP ALT 8084	http-alt-8084	http-alt-8084 http-alt-8084 · via HTTP ALT 8084:8084 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur HTTP-ALT-8084 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8084 Chemin / cible — Service HTTP ALT 8084 Pourquoi cette classification : Type « http-alt-8084 » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Alsycon B.V.", "service": "http-alt-8084", "app_proto": "http-alt-8084", "asn": 49870, "country": "SC", "dst_port": 8084, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.8, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "c2f20fbcd0ce70a3cc1e19e8c731f5f198cf64d1", "event_fingerprint": "8170ddd601d509921d34038746dd865d85f832ec", "classification_reason": "Type \u00ab http-alt-8084 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "http-alt-8084", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "303f60dab84b4cb5700574a7ff1f6e0b" }, "target_context": { "dst_port": 8084, "service": "http-alt-8084", "service_name": "http-alt-8084", "risk_score": 0 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c23a0482ea15a3fe0fadb60347089ef8a074343c", "protocol_details": { "port": 8084, "service": "http-alt-8084", "service_label_fr": "HTTP ALT 8084" }, "attack_vector": "http-alt-8084 \u00b7 via HTTP ALT 8084:8084 \u00b7 (sonde \/ probe)", "target_port_label": "8084 \u00b7 HTTP ALT 8084", "emulator_service": "http-alt-8084", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab http-alt-8084 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab http-alt-8084 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "http-alt-8084", "service_label_fr": "HTTP ALT 8084", "dst_port": 8084, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http-alt-8084", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 8084, "service": "http-alt-8084", "service_label_fr": "HTTP ALT 8084" }, "attack_vector": "http-alt-8084 \u00b7 via HTTP ALT 8084:8084 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "8084 \u00b7 HTTP ALT 8084", "emulator_service": "http-alt-8084", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http_alt_8084", "service_banner": "honeypot-http-alt-8084", "service_os": "linux", "dst_port": "8084" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
16/07/2026 19:50:10 UTC	TCP	8084 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:8084 · (tentative d'exploit)	Élevée	Élevé · 75
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100… Émulateur HTTP WAF 55 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 8084 Chemin / cible / Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 75 Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:8084 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:8084 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: poop1234 Cont Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 9, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "fac64969f9eca34262c56352be2d62dd2d22b1a0", "http_host_hash": "52139ff216422f6e734a2f69155b92f0ec67e9f8", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 909, "payload_entropy": 5.576801619082934, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8084, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 75, "tag_count": 13, "anomaly_count": 0, "campaign_key": "35c161329460faa685a3f8ec6b382d4f11060703", "event_fingerprint": "4701468b6a319e030fbc134f708926cc24f56fbd", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "9f10b48170735feac18b44fa385fef37", "payload_hash": "4983d54d9bc49d1cb8f1041c9b2203e2", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8084, "service": "http", "service_name": "http", "risk_score": 75 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nCont", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nCont", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9059581c8fea6687f4373c147591dbbb356a04e8", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.", "port": 8084, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;", "attack_vector": "http smuggling probe \u00b7 via HTTP:8084 \u00b7 (tentative d'exploit)", "target_port_label": "8084 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 75, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 75, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8084, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.", "port": 8084, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:8084 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8084\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;", "target_port_label": "8084 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8084" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8084" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "950734:sap-sapcontrol-path", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti", "net_web_probe" ] }
16/07/2026 19:11:30 UTC	TCP	82 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:82 · (tentative d'exploit) · → /_next/server	Élevée	Élevé · 74
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /_next/server UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l… Émulateur HTTP WAF 58 Recommandation Investiguer Tags 950019:sqli-4 950326:rce-0 950327:rce-0 950335:rce-2 Cible HTTP POST /_next/server TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 82 Chemin / cible /_next/server Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 74 Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL Ligne de requête `POST /_next/server HTTP/1.1` User-Agent Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Règles WAF sqli-4 rce-0 rce-2 rce-14 nosqli-3 proto-0 upload-0 Payload (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:82 Content-Length: 507 Connection: close User-Agent: Mozilla/5.0 (Linux; Androi Requête brute (extrait) POST /_next/server HTTP/1.1 Host: 62.3.50.33:82 Content-Length: 507 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next Meta JSON brut { "http_header_count": 9, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e", "http_host_hash": "b00c56701bd04898edc8a488547d32d613363649", "http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 935, "payload_entropy": 5.650707890684679, "port_category": "well_known", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 82, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 10, "risk_granularity": 6.2, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 74, "tag_count": 12, "anomaly_count": 0, "campaign_key": "b5afefd736e0932e40d8ef48143ac36183f19fe4", "event_fingerprint": "f7efbe799734f867c572ec64a175166113208601", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842" ], "matched_pattern_names": [ "CRS 921130 duplicate CL" ], "pattern_ids": [ "pat-0842" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 74, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966", "payload_hash": "4a4627ff0d8119b685516c1018e0f46b", "path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056" }, "target_context": { "dst_port": 82, "service": "http", "service_name": "http", "risk_score": 74 }, "payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Androi", "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Androi", "evidence": { "method": "POST", "path": "\/_next\/server", "user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "waf_tags": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0" ], "waf_rule_names": [ "sqli-4", "rce-0", "rce-2", "rce-14", "nosqli-3", "proto-0", "upload-0" ], "request_line": "POST \/_next\/server HTTP\/1.1", "request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext", "payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Androi", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "833d3738fb06b600afcd39725c92dcbd8835d41a", "protocol_details": { "http_method": "POST", "http_path": "\/_next\/server", "request_line": "POST \/_next\/server HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "port": 82, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Androi", "attack_vector": "http smuggling probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server", "target_port_label": "82 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 74, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 74, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 82, "protocol_emulated": null, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/_next\/server", "request_line": "POST \/_next\/server HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36", "port": 82, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:82 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server", "evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:82\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Androi", "target_port_label": "82 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "82" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:82" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950326:rce-0", "950327:rce-0", "950335:rce-2", "950382:rce-14", "950468:nosqli-3", "950470:nosqli-3", "950493:proto-0", "950549:upload-0", "http_contenttype_attack_surface", "http_prototype_pollution", "http_ssti" ] }

160.119.71.136

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence