15/07/2026 20:59:41 UTC
TCP
3001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3001 · (tentative d'exploit)
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3001
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:3001
Content-Length: 512
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86_64) Appl
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:3001 Content-Length: 512 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Requ
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d",
"emulator_response_len": 107,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd",
"http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 917,
"payload_entropy": 5.6284604627138455,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 75,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "5286d7149cff2380a616c8211b39b63366c8dd6f",
"event_fingerprint": "16e2c48fbcd6b17a02278bce3dc927a637697700",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "72d43eb808798db218d063798749cc39",
"payload_hash": "e3ef6f23f3255f42626ea9f0c405a358",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3001,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Appl",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Requ",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Appl",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Requ",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Appl",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a6a98caf089ac89b2dff0aa40d94a5a2bccfdef8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Appl",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)",
"target_port_label": "3001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Appl",
"target_port_label": "3001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"grafana",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
15/07/2026 20:04:36 UTC
TCP
18888 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:18888 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
18888
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:18888
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (iPhone; CP
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:18888 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe",
"http_host_hash": "9da497b227a111b2f7fdb5fd6d68f6b799310816",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 979,
"payload_entropy": 5.686182702351298,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 18888,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "570bf5e3762ce6a6c349913f7317c7c9a802dfe5",
"event_fingerprint": "0aa58d232745b321c9637869c8f5f614d1ad9707",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b",
"payload_hash": "b9f7cd0fd39d768b838bf14c304191fa",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 18888,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CP",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CP",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CP",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d09baa60be8e80f971c763dd6b216d649cd00202",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 18888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CP",
"attack_vector": "http smuggling probe \u00b7 via HTTP:18888 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "18888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 18888,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 18888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:18888 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CP",
"target_port_label": "18888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "18888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:18888"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 20:04:36 UTC
TCP
18888 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:18888 · (tentative d'exploit) · → /app
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
18888
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:18888
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:18888 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-Encoding:
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe",
"http_host_hash": "9da497b227a111b2f7fdb5fd6d68f6b799310816",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 969,
"payload_entropy": 5.677043311578968,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 18888,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "779984d027591560735f4c85571b61d628855b30",
"event_fingerprint": "b0a1446c576a9866b899ddcad7feac7b0d42ff47",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b",
"payload_hash": "c0cba39d6d64fe952d69e8d528c9d221",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 18888,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone ",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding:",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding:",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d7703929c2bf270fd167b1611409ece126e251d2",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 18888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"attack_vector": "http smuggling probe \u00b7 via HTTP:18888 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "18888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 18888,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 18888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:18888 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"target_port_label": "18888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "18888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:18888"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
15/07/2026 20:04:36 UTC
TCP
18888 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:18888 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
18888
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:18888
Content-Length: 512
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:18888 Content-Length: 512 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: poop
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "fac64969f9eca34262c56352be2d62dd2d22b1a0",
"http_host_hash": "9da497b227a111b2f7fdb5fd6d68f6b799310816",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 905,
"payload_entropy": 5.569047161256325,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 18888,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "67280ff4cffeaa933e4d09d8e20261595b5b7e34",
"event_fingerprint": "70c3e7a0f490b1c5436b8ebbf68499e17e73b578",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9f10b48170735feac18b44fa385fef37",
"payload_hash": "7d05f8aca6d1993e53c00bb6c9a1f80f",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 18888,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e095d99ca4993607d86c752b405d297f83ffb836",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 18888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10",
"attack_vector": "http smuggling probe \u00b7 via HTTP:18888 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "18888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 18888,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 18888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:18888 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10",
"target_port_label": "18888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "18888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:18888"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 20:04:35 UTC
TCP
18888 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:18888 · (tentative d'exploit) · → /api
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
18888
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:18888
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:18888 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-Encoding:
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe",
"http_host_hash": "9da497b227a111b2f7fdb5fd6d68f6b799310816",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 963,
"payload_entropy": 5.68216110836462,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 18888,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "ea63a33e6483e1ecf9d6424ffb8832ba65e01803",
"event_fingerprint": "ffad14e8fc6fdc99b5ba28b797aa94f05a795562",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b",
"payload_hash": "74c015cf7c969d51ad25c405be0713be",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 18888,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone ",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding:",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding:",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "79f298f3b69ad43041626a0539bfc2f7ac79ecf3",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 18888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"attack_vector": "http smuggling probe \u00b7 via HTTP:18888 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "18888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 18888,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 18888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:18888 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"target_port_label": "18888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "18888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:18888"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 20:04:34 UTC
TCP
18888 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:18888 · (tentative d'exploit)
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
18888
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:18888
Content-Length: 512
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86_64) App
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:18888 Content-Length: 512 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Req
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd",
"http_host_hash": "9da497b227a111b2f7fdb5fd6d68f6b799310816",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 918,
"payload_entropy": 5.660812537360355,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 18888,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "7a4a1420a1272e184503ecebddd99815a5e8bcae",
"event_fingerprint": "2bb6203d21bef26651dfe3b48508c8ce344d5517",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "72d43eb808798db218d063798749cc39",
"payload_hash": "fb8a8d22a41e01215a90492fec6f7415",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 18888,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) App",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Req",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) App",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Req",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) App",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "84432f44f48dd9b8eac4319d4d379fad3a5ec809",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 18888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) App",
"attack_vector": "http smuggling probe \u00b7 via HTTP:18888 \u00b7 (tentative d'exploit)",
"target_port_label": "18888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 18888,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 18888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:18888 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) App",
"target_port_label": "18888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "18888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:18888"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 20:04:34 UTC
TCP
18888 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:18888 · (tentative d'exploit) · → /_next
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
18888
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:18888
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Intel
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:18888 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Ac
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a",
"http_host_hash": "9da497b227a111b2f7fdb5fd6d68f6b799310816",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 940,
"payload_entropy": 5.649721133163213,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 18888,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "779984d027591560735f4c85571b61d628855b30",
"event_fingerprint": "9712d25adb80072dc4df1d04c99b9899d2f858e8",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de",
"payload_hash": "12f83cb5e7989fdaba8fb38d8d3f1fdc",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 18888,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel ",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Ac",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Ac",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fb2c8a0b3d3934f0a096736e37b4b49d519b59b3",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 18888,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"attack_vector": "http smuggling probe \u00b7 via HTTP:18888 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "18888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 18888,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 18888,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:18888 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18888\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel",
"target_port_label": "18888 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "18888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:18888"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 20:04:33 UTC
TCP
18888
—
Sonde port
Sonde port · port 18888 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
18888
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 18888,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "67ec5c8c8c557f3237dbe92e4771bd31e1c77e12",
"event_fingerprint": "0b87f982b1b86335cd9e7475da53067f4be82722",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 18888,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1032840e9df2bb69cea0317f940147f24f4e1d0e",
"protocol_details": {
"port": 18888
},
"attack_vector": "Sonde port \u00b7 port 18888 \u00b7 (sonde \/ probe)",
"target_port_label": "18888",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 18888,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 18888
},
"attack_vector": "Sonde port \u00b7 port 18888 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "18888",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "18888"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
15/07/2026 19:39:01 UTC
TCP
3127 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3127 · (tentative d'exploit) · → /api
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3127
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:3127
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:3127 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533",
"http_host_hash": "d980a2a7e2d626c5a62fd03aefc2a77a99737299",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 938,
"payload_entropy": 5.644359724471868,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3127,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "dbac0469c2cdcbbff57e09a449f8d450fcaeaecd",
"event_fingerprint": "39e14464d62432c720adbaac1709c0c07a213c8b",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3",
"payload_hash": "3b456da2a51a49e8ad31ed66e4ef6473",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 3127,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f384562067615275a294c39163f2e17420711251",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3127,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3127 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "3127 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3127,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3127,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3127 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "3127 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3127"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3127"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 19:39:01 UTC
TCP
3127 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3127 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3127
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:3127
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (iPhone; CPU
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:3127 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-E
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe",
"http_host_hash": "d980a2a7e2d626c5a62fd03aefc2a77a99737299",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 984,
"payload_entropy": 5.666593199144678,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3127,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "a634c49bc2302f2a5314e357288a825397fa8702",
"event_fingerprint": "b71e435250723223db8732df1ca2d825505da2bd",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b",
"payload_hash": "4cfe55b210daef24bc19ce2ebd94e04c",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 3127,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-E",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-E",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "de0e1e6d5de04c527629aebc75fd793a9986810b",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 3127,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3127 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "3127 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3127,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 3127,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3127 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU",
"target_port_label": "3127 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3127"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3127"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 19:39:01 UTC
TCP
3127 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3127 · (tentative d'exploit) · → /app
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007;…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3127
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:3127
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 14; S
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:3127 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1978af5307537775fab4b66b0f1439319be37ce1",
"http_host_hash": "d980a2a7e2d626c5a62fd03aefc2a77a99737299",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 988,
"payload_entropy": 5.685274098479214,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3127,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "c2e50ffd0c4654e51db04dd508e00cbdf1d0b86c",
"event_fingerprint": "82828783b873f097f1bebd8214904e207665650a",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7967be4fa492cfad4b86b41e3ae090e9",
"payload_hash": "1e659dd2d621deb07f770e0af783f308",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 3127,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b1b6ad6b036e3f6e2d629b2cfd0fc1e4396207ef",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 3127,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3127 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "3127 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3127,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 3127,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3127 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"target_port_label": "3127 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3127"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3127"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 19:39:01 UTC
TCP
3127 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3127 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3127
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:3127
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:3127 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: poop1
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "fac64969f9eca34262c56352be2d62dd2d22b1a0",
"http_host_hash": "d980a2a7e2d626c5a62fd03aefc2a77a99737299",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 918,
"payload_entropy": 5.616788552467357,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3127,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "fcf0830a2930e3feea9c2e04d890ecf77e1b0169",
"event_fingerprint": "c42c3deb9973b34853ecba60be12aea965e43660",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9f10b48170735feac18b44fa385fef37",
"payload_hash": "3c81e9c287f45ec1d544dc088abff1bd",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 3127,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f3eda53dcc73796d5fed770f4705840c8a58fa24",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 3127,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3127 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "3127 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3127,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 3127,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3127 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"target_port_label": "3127 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3127"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3127"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 19:39:00 UTC
TCP
3127 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3127 · (tentative d'exploit) · → /_next
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007;…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3127
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:3127
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 14;
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:3127 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1978af5307537775fab4b66b0f1439319be37ce1",
"http_host_hash": "d980a2a7e2d626c5a62fd03aefc2a77a99737299",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 996,
"payload_entropy": 5.675998009768867,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3127,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "c2e50ffd0c4654e51db04dd508e00cbdf1d0b86c",
"event_fingerprint": "015e72c1e279dfaea731a8833fd81b2397617951",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7967be4fa492cfad4b86b41e3ae090e9",
"payload_hash": "06773ed9277cc46f9dea376a0aee1ef5",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 3127,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "25de8ac6ed51962b27e6e3349684e81c28765df9",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 3127,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3127 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "3127 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3127,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 3127,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3127 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"target_port_label": "3127 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3127"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3127"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 19:38:59 UTC
TCP
3127
—
Sonde port
Sonde port · port 3127 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3127
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 3127,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6fed5cbb3caf5ac86670ab7b580c45bc883d1f00",
"event_fingerprint": "601cfb202157c0a3b29351b766b0030d8deec06d",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 3127,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e92932d1384354ef2d116a3d4f17c37ab828efad",
"protocol_details": {
"port": 3127
},
"attack_vector": "Sonde port \u00b7 port 3127 \u00b7 (sonde \/ probe)",
"target_port_label": "3127",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 3127,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 3127
},
"attack_vector": "Sonde port \u00b7 port 3127 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3127",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "3127"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
15/07/2026 19:38:59 UTC
TCP
3127 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3127 · (tentative d'exploit)
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3127
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:3127
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:3127 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, deflate Next-
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858",
"http_host_hash": "d980a2a7e2d626c5a62fd03aefc2a77a99737299",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 948,
"payload_entropy": 5.64121628506571,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3127,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "c61f97cb0ea3abe9d05a970f2357c967a2574a54",
"event_fingerprint": "b58537d1c27f44cc3a96071445ea4654e7c1e622",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee",
"payload_hash": "51a4c67d70a1fe62ad96f48a6f863b8c",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3127,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nNext-",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nNext-",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "40a196345a60cfb2489c919cd3356a8f1c72d3d3",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 3127,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3127 \u00b7 (tentative d'exploit)",
"target_port_label": "3127 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3127,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 3127,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3127 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3127\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "3127 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3127"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3127"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 19:28:32 UTC
TCP
6008 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:6008 · (tentative d'exploit) · → /app
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
6008
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:6008
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone O
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:6008 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-Encoding:
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe",
"http_host_hash": "a5631611fb9e2823a1c497a068bfef5ccca62287",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 969,
"payload_entropy": 5.654820576034803,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 6008,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "153888f01dbdaf8152916926d7903036c02ef09c",
"event_fingerprint": "4efb982d537995550238d867a56dc5c7106ec737",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b",
"payload_hash": "3f3a2df8388d6a78a6ff57a49f4f6b2a",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 6008,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: ",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: ",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5e486abd3b9f0d5e716ac8c0fc256843fa25fe21",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 6008,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"attack_vector": "http smuggling probe \u00b7 via HTTP:6008 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "6008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6008,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 6008,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:6008 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"target_port_label": "6008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6008"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:6008"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 19:28:32 UTC
TCP
6008 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:6008 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
6008
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:6008
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:6008 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Actio
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533",
"http_host_hash": "a5631611fb9e2823a1c497a068bfef5ccca62287",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 950,
"payload_entropy": 5.6246023858179575,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 6008,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "0c8ef646fff31d5003ae5dad6f84a9d9897f4b75",
"event_fingerprint": "5fd06e5558ab25023a9445257c260bdbbff2575f",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3",
"payload_hash": "73fffa6dc058e7abd3573ed23615fcb3",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 6008,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2652bef3d9710e0a02e4618101aa630b26c79571",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 6008,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"attack_vector": "http smuggling probe \u00b7 via HTTP:6008 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "6008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6008,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 6008,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:6008 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"target_port_label": "6008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6008"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:6008"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 19:28:31 UTC
TCP
6008 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:6008 · (tentative d'exploit) · → /api
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
6008
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:6008
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86_64) A
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:6008 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-R
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd",
"http_host_hash": "a5631611fb9e2823a1c497a068bfef5ccca62287",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 928,
"payload_entropy": 5.6653397947354085,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 6008,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "e4c398b9e6e0b9f635ce36876a1077f09379c511",
"event_fingerprint": "431ec0b7dc778c0ff04f6514364f4e99499a79b3",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "72d43eb808798db218d063798749cc39",
"payload_hash": "4141f6a20c4d9d43ff31fe44bcd67975",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 6008,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-R",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-R",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "92d65caf38752d480c39f27dc79f5c35a91804c3",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 6008,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"attack_vector": "http smuggling probe \u00b7 via HTTP:6008 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "6008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6008,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 6008,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:6008 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"target_port_label": "6008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6008"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:6008"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 19:28:31 UTC
TCP
6008 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:6008 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
6008
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:6008
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Macintosh;
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:6008 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate N
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a",
"http_host_hash": "a5631611fb9e2823a1c497a068bfef5ccca62287",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 953,
"payload_entropy": 5.628307649064357,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 6008,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "cb3c35bdefbf02033e0e1c4b3142fd0b6ec9e87d",
"event_fingerprint": "186f8ada2c7192c1d19896d3c21314d9b2db8732",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de",
"payload_hash": "2ebfd39329498c571dc7898c15d4420d",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 6008,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; ",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6f0787f290bb74f74cd67555b20795e2393bfbd1",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 6008,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"attack_vector": "http smuggling probe \u00b7 via HTTP:6008 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "6008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6008,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 6008,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:6008 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"target_port_label": "6008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6008"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:6008"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 19:28:30 UTC
TCP
6008 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:6008 · (tentative d'exploit) · → /_next
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
6008
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:6008
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:6008 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-Encoding
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe",
"http_host_hash": "a5631611fb9e2823a1c497a068bfef5ccca62287",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 971,
"payload_entropy": 5.670045117020829,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 6008,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "153888f01dbdaf8152916926d7903036c02ef09c",
"event_fingerprint": "11181f9eadf87564c89581e64e74e455154c86a8",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b",
"payload_hash": "2c2e47e79bb7bf3294971b5600b987b1",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 6008,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "339c0526a41a37bcc22bdf692c5ddd39be6a77ea",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 6008,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"attack_vector": "http smuggling probe \u00b7 via HTTP:6008 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "6008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6008,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 6008,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:6008 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"target_port_label": "6008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6008"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:6008"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 19:28:29 UTC
TCP
6008 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:6008 · (tentative d'exploit)
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) Appl…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
6008
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:6008
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWM
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:6008 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36 Accept-Enco
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
"http_host_hash": "a5631611fb9e2823a1c497a068bfef5ccca62287",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 981,
"payload_entropy": 5.6891543842557795,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 6008,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "f65c219a7be2b34d191fccbd2ffa775e6d29f55c",
"event_fingerprint": "3dddce3ac55c8f9cbce7578194c99835b39d521e",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c772734c6eb2978096c283068906aec3",
"payload_hash": "77ccba3991db2cd8a9b75b3a7bb8d861",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 6008,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-Enco",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-Enco",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bba21e32f49987e03ff5467b0cd0efeb3b8e6455",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 6008,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"attack_vector": "http smuggling probe \u00b7 via HTTP:6008 \u00b7 (tentative d'exploit)",
"target_port_label": "6008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6008,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 6008,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:6008 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6008\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"target_port_label": "6008 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6008"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:6008"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 19:28:28 UTC
TCP
6008
—
Sonde port
Sonde port · port 6008 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
6008
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 6008,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "ee8ec425decae25cb71b26fb42838bcaf99e6e54",
"event_fingerprint": "8182444167277ca7111ccf640b5ac893f4b5f35c",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 6008,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e72cccabff6d2ecfc540c33a927a665f2fcc749c",
"protocol_details": {
"port": 6008
},
"attack_vector": "Sonde port \u00b7 port 6008 \u00b7 (sonde \/ probe)",
"target_port_label": "6008",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 6008,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 6008
},
"attack_vector": "Sonde port \u00b7 port 6008 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "6008",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "6008"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
15/07/2026 18:50:33 UTC
TCP
8112 · HTTP
Prototype pollution
prototype pollution · via HTTP:8112 · (tentative d'exploit) · → /api
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8112
Chemin / cible
/api
Pourquoi cette classification : Règle WAF « proto-0 » · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Élevé
· 69
Confiance : Confiance 50 % — 9 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:8112
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:8112 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, deflate Ne
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858",
"http_host_hash": "d87c9eb95a0723896f979762e39c08249592bad6",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 945,
"payload_entropy": 5.663686758388502,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8112,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 69,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "f05db28648738647939126b6bf056b978f1050e4",
"event_fingerprint": "3dd344dccda6298a96823ac0e333cc8a9ec3f97e",
"classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee",
"payload_hash": "c5f3fe0295baf2b1f5073b6c246ff5d0",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 8112,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nNe",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nNe",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "be50ee3b561dc79695aad7c0a631e1c405ddc7bf",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 8112,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "prototype pollution \u00b7 via HTTP:8112 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "8112 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8112,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 8112,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "prototype pollution \u00b7 via HTTP:8112 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "8112 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8112"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:8112"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 18:50:33 UTC
TCP
8112 · HTTP
Prototype pollution
prototype pollution · via HTTP:8112 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8112
Chemin / cible
/_next/server
Pourquoi cette classification : Règle WAF « proto-0 » · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Élevé
· 69
Confiance : Confiance 50 % — 9 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:8112
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:8112 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Act
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "d87c9eb95a0723896f979762e39c08249592bad6",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 946,
"payload_entropy": 5.6658901051216075,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8112,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 69,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "6502f51c5fa808ad87355ddfd90105b6011c6321",
"event_fingerprint": "0f5388297887d37900f1aba939ec82e0ebe2c7a5",
"classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "dde57a71cb253682f1bfd9ffd3b9cffa",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 8112,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Act",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Act",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "addb9b5de498a5774881bc1ccefdcc53b72f979e",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8112,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"attack_vector": "prototype pollution \u00b7 via HTTP:8112 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "8112 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8112,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8112,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "prototype pollution \u00b7 via HTTP:8112 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"target_port_label": "8112 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8112"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:8112"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 18:50:33 UTC
TCP
8112 · HTTP
Prototype pollution
prototype pollution · via HTTP:8112 · (tentative d'exploit) · → /app
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8112
Chemin / cible
/app
Pourquoi cette classification : Règle WAF « proto-0 » · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Élevé
· 69
Confiance : Confiance 50 % — 8 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:8112
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 10; K
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:8112 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-Action
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e",
"http_host_hash": "d87c9eb95a0723896f979762e39c08249592bad6",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 936,
"payload_entropy": 5.6449154212062425,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8112,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 69,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "a7adf1ad04494dac66110c8fbb8a012a3bc69cc0",
"event_fingerprint": "93bde01a7abc123941c2bb4936d9df8d5d059e0e",
"classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966",
"payload_hash": "f694627d9ea16b19d7e7b6e68569dc7d",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 8112,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "edd0724bea50808ca057c05338e9c1009b5659f2",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 8112,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"attack_vector": "prototype pollution \u00b7 via HTTP:8112 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "8112 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8112,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 8112,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "prototype pollution \u00b7 via HTTP:8112 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"target_port_label": "8112 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8112"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:8112"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 18:50:33 UTC
TCP
8112 · HTTP
Énumération API REST
rest api enum · via HTTP:8112 · (sonde / probe) · → /api/route
Élevée
Élevé · 65
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
POST /api/route UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8112
Chemin / cible
/api/route
Pourquoi cette classification : Énumération API REST (tag sqli-4) · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Élevé
· 65
Confiance : Confiance 50 % — 10 tag(s) WAF
Signaux
Upstream
Api Probe Generic
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:8112
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:8112 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: poop1
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "fac64969f9eca34262c56352be2d62dd2d22b1a0",
"http_host_hash": "d87c9eb95a0723896f979762e39c08249592bad6",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 911,
"payload_entropy": 5.624665779495418,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8112,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 65,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "a29989dd9776373730323ff7f8879ec942704091",
"event_fingerprint": "20aa9e0b4553ca1c68e914d8f274d0d71673ce37",
"classification_reason": "\u00c9num\u00e9ration API REST (tag sqli-4) \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 65,
"precision_signals": [
"INT-upstream",
"INT-api-probe-generic"
],
"kb_rule_ids": [
"INT-upstream",
"INT-api-probe-generic"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9f10b48170735feac18b44fa385fef37",
"payload_hash": "2cfed4261042685b6d61027c0570011e",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 8112,
"service": "http",
"service_name": "http",
"risk_score": 65
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"classification_reason": "\u00c9num\u00e9ration API REST (tag sqli-4) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0f6a0b6c126d87ec36d39cdd8bc45f5e516a10a5",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 8112,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"attack_vector": "rest api enum \u00b7 via HTTP:8112 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/api\/route",
"target_port_label": "8112 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "\u00c9num\u00e9ration API REST (tag sqli-4) \u00b7 confiance 50%",
"classification_reason_label_fr": "\u00c9num\u00e9ration API REST (tag sqli-4) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0007 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 65,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 65,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8112,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-api-probe-generic"
],
"tags_summary_labels_fr": [
"Upstream",
"Api Probe Generic"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 8112,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "rest api enum \u00b7 via HTTP:8112 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"target_port_label": "8112 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8112"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:8112"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 18:50:32 UTC
TCP
8112 · HTTP
Prototype pollution
prototype pollution · via HTTP:8112 · (tentative d'exploit) · → /_next
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007;…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8112
Chemin / cible
/_next
Pourquoi cette classification : Règle WAF « proto-0 » · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Élevé
· 69
Confiance : Confiance 50 % — 8 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:8112
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 14;
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:8112 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1978af5307537775fab4b66b0f1439319be37ce1",
"http_host_hash": "d87c9eb95a0723896f979762e39c08249592bad6",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 989,
"payload_entropy": 5.65629451848241,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8112,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 69,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "a7adf1ad04494dac66110c8fbb8a012a3bc69cc0",
"event_fingerprint": "9c50cd22100d467ec73e85506b375bd54be2965d",
"classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7967be4fa492cfad4b86b41e3ae090e9",
"payload_hash": "213d8bf2be3f397e3474e4a275ad0f41",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 8112,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d9efa6aacb9a76c878c709f883cca47dbade6a19",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 8112,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"attack_vector": "prototype pollution \u00b7 via HTTP:8112 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "8112 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8112,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 8112,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "prototype pollution \u00b7 via HTTP:8112 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"target_port_label": "8112 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8112"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:8112"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 18:50:31 UTC
TCP
8112
—
Sonde port
Sonde port · port 8112 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8112
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 8112,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "23cb314e89d2d143339746436cea6b13990fa06e",
"event_fingerprint": "3ea1613379cab0d5c7abeed436a23244e835aed2",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 8112,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f7789c5a7355ca9b51756a7dc8465592472a7228",
"protocol_details": {
"port": 8112
},
"attack_vector": "Sonde port \u00b7 port 8112 \u00b7 (sonde \/ probe)",
"target_port_label": "8112",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 8112,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 8112
},
"attack_vector": "Sonde port \u00b7 port 8112 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8112",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "8112"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
15/07/2026 18:50:31 UTC
TCP
8112 · HTTP
Prototype pollution
prototype pollution · via HTTP:8112 · (tentative d'exploit)
Élevée
Élevé · 69
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8112
Chemin / cible
/
Pourquoi cette classification : Règle WAF « proto-0 » · confiance 50%
Confiance classification
58%
Corrélation +8
Risque capteur
Élevé
· 69
Confiance : Confiance 50 % — 9 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:8112
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 10; K) A
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:8112 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e",
"http_host_hash": "d87c9eb95a0723896f979762e39c08249592bad6",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 940,
"payload_entropy": 5.662367433887103,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8112,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 69,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "9c9c1469f035655c708f56f8cb8baf2e126172c2",
"event_fingerprint": "27db1ac29d6a68892adace41be106cefd870b628",
"classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%",
"confidence": 0.58,
"classification_confidence": 0.58,
"precision_score": 55,
"precision_signals": [
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-upstream",
"INT-waf-score"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966",
"payload_hash": "d0140ff0d96b56bd095bd8fd003b04cd",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8112,
"service": "http",
"service_name": "http",
"risk_score": 69
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2c5036dcb13e8a18c60bf41e41df035266c14c60",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 8112,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"attack_vector": "prototype pollution \u00b7 via HTTP:8112 \u00b7 (tentative d'exploit)",
"target_port_label": "8112 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%",
"classification_reason_label_fr": "R\u00e8gle WAF \u00ab proto-0 \u00bb \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 69\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 58,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 69,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 69,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8112,
"protocol_emulated": null,
"tags_summary": [
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 8112,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "prototype pollution \u00b7 via HTTP:8112 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8112\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"target_port_label": "8112 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8112"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:8112"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"matched_patterns": [],
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 16:40:46 UTC
TCP
554 · RTSP
Sonde HTTP smuggling
http smuggling probe · via RTSP:554 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
RTSP
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
554
Chemin / cible
—
Service
RTSP
Payload
POST /api/route HTTP/1.1 Host: 62.3.50.33:554 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_6
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:554
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_6
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:554 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a",
"emulator_response_len": 63,
"bytes_in": 942,
"payload_entropy": 5.639241715250986,
"port_category": "well_known",
"org": "Alsycon B.V.",
"service": "rtsp",
"app_proto": "rtsp",
"asn": 49870,
"country": "SC",
"dst_port": 554,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "1580e29a640815e1d168730043e0bfb62d6fa957",
"event_fingerprint": "d54c4b6fa0b1fdb4dbd8c64616c167e5a9d716e8",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "rtsp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "94d2b7c900da8e56ad65ec1eee65560c",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 554,
"service": "rtsp",
"service_name": "rtsp",
"risk_score": 52
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_6",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action:",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_6",
"evidence": {
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action:",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_6",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "21c8d956f82e1163601b04ac70bdf6760b387e3e",
"protocol_details": {
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_6",
"port": 554,
"service": "rtsp",
"service_label_fr": "RTSP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_6",
"attack_vector": "http smuggling probe \u00b7 via RTSP:554 \u00b7 (tentative d'exploit)",
"target_port_label": "554 \u00b7 RTSP",
"emulator_service": "rtsp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via RTSP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "rtsp",
"service_label_fr": "RTSP",
"dst_port": 554,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rtsp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_6",
"port": 554,
"service": "rtsp",
"service_label_fr": "RTSP"
},
"attack_vector": "http smuggling probe \u00b7 via RTSP:554 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_6",
"target_port_label": "554 \u00b7 RTSP",
"emulator_service": "rtsp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rtsp",
"service_banner": "honeypot-rtsp",
"service_os": "linux",
"dst_port": "554"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
15/07/2026 16:40:45 UTC
TCP
554 · RTSP
Sonde HTTP smuggling
http smuggling probe · via RTSP:554 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
RTSP
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
554
Chemin / cible
—
Service
RTSP
Payload
POST /api HTTP/1.1 Host: 62.3.50.33:554 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win6
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:554
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win6
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:554 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a",
"emulator_response_len": 63,
"bytes_in": 936,
"payload_entropy": 5.647381598373723,
"port_category": "well_known",
"org": "Alsycon B.V.",
"service": "rtsp",
"app_proto": "rtsp",
"asn": 49870,
"country": "SC",
"dst_port": 554,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "1580e29a640815e1d168730043e0bfb62d6fa957",
"event_fingerprint": "d54c4b6fa0b1fdb4dbd8c64616c167e5a9d716e8",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "rtsp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "df8d9f21a7aaddee757268d657be5f0f",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 554,
"service": "rtsp",
"service_name": "rtsp",
"risk_score": 52
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"evidence": {
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5ff0529f0d826e3cea4094a15acd36d4951a01ed",
"protocol_details": {
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"port": 554,
"service": "rtsp",
"service_label_fr": "RTSP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"attack_vector": "http smuggling probe \u00b7 via RTSP:554 \u00b7 (tentative d'exploit)",
"target_port_label": "554 \u00b7 RTSP",
"emulator_service": "rtsp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via RTSP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "rtsp",
"service_label_fr": "RTSP",
"dst_port": 554,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rtsp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"port": 554,
"service": "rtsp",
"service_label_fr": "RTSP"
},
"attack_vector": "http smuggling probe \u00b7 via RTSP:554 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"target_port_label": "554 \u00b7 RTSP",
"emulator_service": "rtsp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rtsp",
"service_banner": "honeypot-rtsp",
"service_os": "linux",
"dst_port": "554"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
15/07/2026 16:40:45 UTC
TCP
554 · RTSP
Sonde HTTP smuggling
http smuggling probe · via RTSP:554 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
RTSP
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
554
Chemin / cible
—
Service
RTSP
Payload
POST /_next/server HTTP/1.1 Host: 62.3.50.33:554 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (Windows NT 1
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:554
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 1
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:554 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: poo
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a",
"emulator_response_len": 63,
"bytes_in": 907,
"payload_entropy": 5.61079025615496,
"port_category": "well_known",
"org": "Alsycon B.V.",
"service": "rtsp",
"app_proto": "rtsp",
"asn": 49870,
"country": "SC",
"dst_port": 554,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "1580e29a640815e1d168730043e0bfb62d6fa957",
"event_fingerprint": "d54c4b6fa0b1fdb4dbd8c64616c167e5a9d716e8",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "rtsp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c66981ec4ee13d1cc1ef9b4951249a2f",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 554,
"service": "rtsp",
"service_name": "rtsp",
"risk_score": 52
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poo",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 1",
"evidence": {
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poo",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 1",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2078908a04b7370c38da4c3699144d25811ba58",
"protocol_details": {
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 1",
"port": 554,
"service": "rtsp",
"service_label_fr": "RTSP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 1",
"attack_vector": "http smuggling probe \u00b7 via RTSP:554 \u00b7 (tentative d'exploit)",
"target_port_label": "554 \u00b7 RTSP",
"emulator_service": "rtsp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via RTSP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "rtsp",
"service_label_fr": "RTSP",
"dst_port": 554,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rtsp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 1",
"port": 554,
"service": "rtsp",
"service_label_fr": "RTSP"
},
"attack_vector": "http smuggling probe \u00b7 via RTSP:554 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 1",
"target_port_label": "554 \u00b7 RTSP",
"emulator_service": "rtsp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rtsp",
"service_banner": "honeypot-rtsp",
"service_os": "linux",
"dst_port": "554"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
15/07/2026 16:40:45 UTC
TCP
554 · RTSP
Sonde HTTP smuggling
http smuggling probe · via RTSP:554 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
RTSP
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
554
Chemin / cible
—
Service
RTSP
Payload
POST /app HTTP/1.1 Host: 62.3.50.33:554 Content-Length: 497 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:554
Content-Length: 497
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 14; SM
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:554 Content-Length: 497 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a",
"emulator_response_len": 63,
"bytes_in": 958,
"payload_entropy": 5.672107462160107,
"port_category": "well_known",
"org": "Alsycon B.V.",
"service": "rtsp",
"app_proto": "rtsp",
"asn": 49870,
"country": "SC",
"dst_port": 554,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "1580e29a640815e1d168730043e0bfb62d6fa957",
"event_fingerprint": "d54c4b6fa0b1fdb4dbd8c64616c167e5a9d716e8",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "rtsp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3d7c9e70b3a4e7281239f10ebab0a01c",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 554,
"service": "rtsp",
"service_name": "rtsp",
"risk_score": 52
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 497\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 497\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36\r",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 497\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM",
"evidence": {
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 497\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36\r",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 497\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2c0165e545733482c412286c0c1b271b7c02e53",
"protocol_details": {
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 497\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM",
"port": 554,
"service": "rtsp",
"service_label_fr": "RTSP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 497\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM",
"attack_vector": "http smuggling probe \u00b7 via RTSP:554 \u00b7 (tentative d'exploit)",
"target_port_label": "554 \u00b7 RTSP",
"emulator_service": "rtsp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via RTSP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "rtsp",
"service_label_fr": "RTSP",
"dst_port": 554,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rtsp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 497\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM",
"port": 554,
"service": "rtsp",
"service_label_fr": "RTSP"
},
"attack_vector": "http smuggling probe \u00b7 via RTSP:554 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 497\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM",
"target_port_label": "554 \u00b7 RTSP",
"emulator_service": "rtsp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rtsp",
"service_banner": "honeypot-rtsp",
"service_os": "linux",
"dst_port": "554"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
15/07/2026 16:40:44 UTC
TCP
554 · RTSP
Sonde HTTP smuggling
http smuggling probe · via RTSP:554 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
RTSP
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
554
Chemin / cible
—
Service
RTSP
Payload
POST /_next HTTP/1.1 Host: 62.3.50.33:554 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64)
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:554
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86_64)
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:554 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a",
"emulator_response_len": 63,
"bytes_in": 922,
"payload_entropy": 5.659825291035015,
"port_category": "well_known",
"org": "Alsycon B.V.",
"service": "rtsp",
"app_proto": "rtsp",
"asn": 49870,
"country": "SC",
"dst_port": 554,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "1580e29a640815e1d168730043e0bfb62d6fa957",
"event_fingerprint": "d54c4b6fa0b1fdb4dbd8c64616c167e5a9d716e8",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "rtsp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9ad93d9732bca830fc097720810ccde5",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 554,
"service": "rtsp",
"service_name": "rtsp",
"risk_score": 52
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) ",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"evidence": {
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "faa658c474155db881abef11ed9fb31f6550bcfe",
"protocol_details": {
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"port": 554,
"service": "rtsp",
"service_label_fr": "RTSP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"attack_vector": "http smuggling probe \u00b7 via RTSP:554 \u00b7 (tentative d'exploit)",
"target_port_label": "554 \u00b7 RTSP",
"emulator_service": "rtsp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via RTSP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "rtsp",
"service_label_fr": "RTSP",
"dst_port": 554,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rtsp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"port": 554,
"service": "rtsp",
"service_label_fr": "RTSP"
},
"attack_vector": "http smuggling probe \u00b7 via RTSP:554 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"target_port_label": "554 \u00b7 RTSP",
"emulator_service": "rtsp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rtsp",
"service_banner": "honeypot-rtsp",
"service_os": "linux",
"dst_port": "554"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
15/07/2026 16:40:42 UTC
TCP
554 · RTSP
rtsp
rtsp · via RTSP:554 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
RTSP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
554
Chemin / cible
—
Pourquoi cette classification : Type « rtsp » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a",
"emulator_response_len": 63,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Alsycon B.V.",
"service": "rtsp",
"app_proto": "rtsp",
"asn": 49870,
"country": "SC",
"dst_port": 554,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8e3f9e48f39b04739815fd1693b1af90d71a227f",
"event_fingerprint": "f089fe7be3f172bb5e3847a38a4c2e2a5878053f",
"classification_reason": "Type \u00ab rtsp \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "rtsp",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6fb9e4f877fce8e8134bd958993fdfda"
},
"target_context": {
"dst_port": 554,
"service": "rtsp",
"service_name": "rtsp",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cc4a69e3fd4749e6222d364c76dd8683de330cb8",
"protocol_details": {
"port": 554,
"service": "rtsp",
"service_label_fr": "RTSP"
},
"attack_vector": "rtsp \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)",
"target_port_label": "554 \u00b7 RTSP",
"emulator_service": "rtsp",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab rtsp \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab rtsp \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "rtsp",
"service_label_fr": "RTSP",
"dst_port": 554,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rtsp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 554,
"service": "rtsp",
"service_label_fr": "RTSP"
},
"attack_vector": "rtsp \u00b7 via RTSP:554 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "554 \u00b7 RTSP",
"emulator_service": "rtsp",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rtsp",
"service_banner": "honeypot-rtsp",
"service_os": "linux",
"dst_port": "554"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
15/07/2026 16:40:42 UTC
TCP
554 · RTSP
Sonde HTTP smuggling
http smuggling probe · via RTSP:554 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
RTSP
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
554
Chemin / cible
—
Service
RTSP
Payload
POST / HTTP/1.1 Host: 62.3.50.33:554 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:554
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:554 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Nex
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "525453502f312e3020323030204f4b0d0a435365713a20310d0a5075626c69633a2044455343524942452c2053455455502c2054454152444f574e0d0a0d0a",
"emulator_response_len": 63,
"bytes_in": 932,
"payload_entropy": 5.664873716049863,
"port_category": "well_known",
"org": "Alsycon B.V.",
"service": "rtsp",
"app_proto": "rtsp",
"asn": 49870,
"country": "SC",
"dst_port": 554,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 5,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "1580e29a640815e1d168730043e0bfb62d6fa957",
"event_fingerprint": "d54c4b6fa0b1fdb4dbd8c64616c167e5a9d716e8",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "rtsp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4b1cfc325e8978f105b689a410f8822a",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 554,
"service": "rtsp",
"service_name": "rtsp",
"risk_score": 52
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nex",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0",
"evidence": {
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nex",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c1e6412e1206b4303a45e93740865d179c2e2790",
"protocol_details": {
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0",
"port": 554,
"service": "rtsp",
"service_label_fr": "RTSP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0",
"attack_vector": "http smuggling probe \u00b7 via RTSP:554 \u00b7 (tentative d'exploit)",
"target_port_label": "554 \u00b7 RTSP",
"emulator_service": "rtsp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via RTSP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "rtsp",
"service_label_fr": "RTSP",
"dst_port": 554,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-rtsp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0",
"port": 554,
"service": "rtsp",
"service_label_fr": "RTSP"
},
"attack_vector": "http smuggling probe \u00b7 via RTSP:554 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:554\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0",
"target_port_label": "554 \u00b7 RTSP",
"emulator_service": "rtsp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "rtsp",
"service_banner": "honeypot-rtsp",
"service_os": "linux",
"dst_port": "554"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
15/07/2026 12:19:48 UTC
TCP
3123 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3123 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3123
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:3123
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Windows NT
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:3123 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, de
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858",
"http_host_hash": "8ea7173663d9a2c46ed3a1dc8067654d2a0fab58",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 961,
"payload_entropy": 5.6231181363103655,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3123,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "380be5236838006d065af23bfe4f43d5bb2eba3c",
"event_fingerprint": "64408b4afca6d644fc00bec42965548818b1e288",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee",
"payload_hash": "fddb517142b1ac1d0b9e0a2976f30649",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 3123,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT ",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, de",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, de",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ef8111fdc66ee7c5dad11ccf1e7d48e0fbbfd975",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 3123,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3123 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "3123 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3123,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 3123,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3123 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"target_port_label": "3123 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3123"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3123"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 12:19:48 UTC
TCP
3123 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3123 · (tentative d'exploit) · → /app
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3123
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:3123
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:3123 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Actio
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a",
"http_host_hash": "8ea7173663d9a2c46ed3a1dc8067654d2a0fab58",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 944,
"payload_entropy": 5.652676331889492,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3123,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "44b226446c08ff24acee6f343a354421b0604143",
"event_fingerprint": "8477f12bdefd4d66d1eaaea66a2811507428b3c6",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de",
"payload_hash": "76e13ea4b904ddcbd1c6e5e29ae83a4a",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 3123,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c1fd35b29a4cfe930a5d14ea9ddf6283bc826e10",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3123,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3123 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "3123 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3123,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3123,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3123 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "3123 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3123"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3123"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 12:19:48 UTC
TCP
3123 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3123 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3123
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:3123
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Int
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:3123 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a",
"http_host_hash": "8ea7173663d9a2c46ed3a1dc8067654d2a0fab58",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 950,
"payload_entropy": 5.654880228654127,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3123,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "bbc3541237b12569fedbf60256b8e2b2d5bab1e0",
"event_fingerprint": "28bc1fb9c388d536f673f242a001a0c1828d478c",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de",
"payload_hash": "41610a26be38a795209226da970da20d",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 3123,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c9f7b43226eeaa77d26d8cc36601615c27f71cfc",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3123,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3123 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "3123 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3123,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3123,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3123 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"target_port_label": "3123 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3123"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3123"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 12:19:47 UTC
TCP
3123 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3123 · (tentative d'exploit) · → /api
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3123
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:3123
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; Android 4.
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:3123 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gzip, de
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea",
"http_host_hash": "8ea7173663d9a2c46ed3a1dc8067654d2a0fab58",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 961,
"payload_entropy": 5.653980909860511,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3123,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "cc878fdf50bce66c4c8ca597a8cae9dda6d5a484",
"event_fingerprint": "393e81832bccf9031cad6ba564156abfdcd52e52",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6c8160595869adea51d6742918f57fdf",
"payload_hash": "720fc07983409f35e223616e040f95e7",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 3123,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, de",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, de",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fcc91b4643a70826a5f0829b966adfa90515c9b7",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 3123,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3123 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "3123 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3123,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 3123,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3123 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"target_port_label": "3123 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3123"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3123"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 12:19:45 UTC
TCP
3123 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3123 · (tentative d'exploit)
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3123
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:3123
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 10; K) A
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:3123 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e",
"http_host_hash": "8ea7173663d9a2c46ed3a1dc8067654d2a0fab58",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 933,
"payload_entropy": 5.649723811424832,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3123,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "be2542a48f6e2d32de3be7f6ea078a9710b21c3f",
"event_fingerprint": "fed4df4276aba81dd38345b7be4b15754acd3ffb",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966",
"payload_hash": "8ab8601076c3cad88ca89692ceca4d67",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3123,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a10a329a5bb6afa0dba8d66a47434579e2b82974",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 3123,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3123 \u00b7 (tentative d'exploit)",
"target_port_label": "3123 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3123,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 3123,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3123 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"target_port_label": "3123 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3123"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3123"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 12:19:45 UTC
TCP
3123 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3123 · (tentative d'exploit) · → /_next
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3123
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:3123
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; Android
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:3123 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gzip,
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea",
"http_host_hash": "8ea7173663d9a2c46ed3a1dc8067654d2a0fab58",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 969,
"payload_entropy": 5.684344726942927,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3123,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "44b226446c08ff24acee6f343a354421b0604143",
"event_fingerprint": "4bcac40d8116c3e74abe6323dcae59fec46f7717",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6c8160595869adea51d6742918f57fdf",
"payload_hash": "f75c195bcfb9b3225aff026a2f5a0ae1",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 3123,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android ",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, ",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, ",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cb546c7a9c6511f5f67a9f2e1d3ec45f1c8174b9",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 3123,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3123 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "3123 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3123,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 3123,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3123 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3123\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android",
"target_port_label": "3123 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3123"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3123"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 12:19:44 UTC
TCP
3123
—
Sonde port
Sonde port · port 3123 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3123
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 3123,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "39d21c6f7f5a1ae2460448ff4b7452c7c0f6213a",
"event_fingerprint": "dff0801b550020794ccc82ed9480fb3aedff93e3",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 3123,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "abbb78a639d28c62534151138c86a26e08277534",
"protocol_details": {
"port": 3123
},
"attack_vector": "Sonde port \u00b7 port 3123 \u00b7 (sonde \/ probe)",
"target_port_label": "3123",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 3123,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 3123
},
"attack_vector": "Sonde port \u00b7 port 3123 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3123",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "3123"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
15/07/2026 11:45:57 UTC
TCP
3310 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3310 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3310
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:3310
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:3310 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, defla
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858",
"http_host_hash": "24ff46737ca30ff0aba383880e6daf45a53ad85e",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 958,
"payload_entropy": 5.652181387868441,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3310,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.8,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "cbdf3f8eeae0db44a5c5002bcc9ee3ac84f3b5c7",
"event_fingerprint": "1d09b551b301df45c105780d4c24d23cb5a9166f",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee",
"payload_hash": "9e30f9b2284c2e3657d41cd959c584f5",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 3310,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "348c75bf34fca8cb5914f14977845fb1567ba853",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 3310,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3310 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "3310 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3310,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 3310,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3310 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"target_port_label": "3310 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3310"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3310"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
15/07/2026 11:45:56 UTC
TCP
3310 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3310 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) Appl…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3310
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:3310
Content-Length: 512
Connection: close
User-Agent: Mozilla/5.0 (Linux; Andr
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:3310 Content-Length: 512 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
"http_host_hash": "24ff46737ca30ff0aba383880e6daf45a53ad85e",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 979,
"payload_entropy": 5.680541490233249,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3310,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.8,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "b084773bf7bc771160c3b90035823f57057cbd74",
"event_fingerprint": "a73571c52e821e9e6ade4aec3a224dab12b592b8",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c772734c6eb2978096c283068906aec3",
"payload_hash": "58c6ab9c3386ce7083af7b1ef93aa527",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 3310,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c933d0bba0931ff7c505c1bdcdc6a03a1262afe0",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 3310,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3310 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "3310 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3310,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 3310,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3310 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"target_port_label": "3310 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3310"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3310"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 11:45:56 UTC
TCP
3310 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3310 · (tentative d'exploit) · → /app
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3310
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:3310
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:3310 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533",
"http_host_hash": "24ff46737ca30ff0aba383880e6daf45a53ad85e",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 938,
"payload_entropy": 5.6309631894677326,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3310,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.8,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "c4f620842389c125f5dd142c854b552c66c9eb9a",
"event_fingerprint": "df209dbcc145af6dbb1b0e63d836350b3eca04e9",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3",
"payload_hash": "27c40ad3a6d07792527e7325d9f03276",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 3310,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4708afba0c8112a18ca81b7d36e5ad85b02e29c9",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3310,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3310 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "3310 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3310,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3310,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3310 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "3310 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3310"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3310"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 11:45:55 UTC
TCP
3310 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3310 · (tentative d'exploit) · → /api
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007;…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3310
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:3310
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 14; S
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:3310 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1978af5307537775fab4b66b0f1439319be37ce1",
"http_host_hash": "24ff46737ca30ff0aba383880e6daf45a53ad85e",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 988,
"payload_entropy": 5.676969648224658,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3310,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.8,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "e0638db74e4e44d23f03d4201b31ff8320bc2e1a",
"event_fingerprint": "35b731ac5f2d11f6f6fd3908ce2c047ce9e1dc4a",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7967be4fa492cfad4b86b41e3ae090e9",
"payload_hash": "26e7cd52cea53d3a0fe920a9f6fcded6",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 3310,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "62530c7cc7137ab1cde655d481d370e573c1f24d",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 3310,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3310 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "3310 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3310,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 3310,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3310 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"target_port_label": "3310 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3310"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3310"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 11:45:54 UTC
TCP
3310 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3310 · (tentative d'exploit) · → /_next
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007;…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3310
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:3310
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 14;
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:3310 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1978af5307537775fab4b66b0f1439319be37ce1",
"http_host_hash": "24ff46737ca30ff0aba383880e6daf45a53ad85e",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 983,
"payload_entropy": 5.674558007257171,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3310,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.8,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "c4f620842389c125f5dd142c854b552c66c9eb9a",
"event_fingerprint": "0ae9137c50eef5f7e81174077b5e4bfde9386d52",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7967be4fa492cfad4b86b41e3ae090e9",
"payload_hash": "c80d8d6de254ea886a10bbe7e8a46fc2",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 3310,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4f5dedd82e2e107a43598cf501e20606c315ad28",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 3310,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3310 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "3310 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3310,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 3310,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3310 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"target_port_label": "3310 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3310"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3310"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 11:45:53 UTC
TCP
3310 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3310 · (tentative d'exploit)
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3310
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:3310
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:3310 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gzip, defla
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea",
"http_host_hash": "24ff46737ca30ff0aba383880e6daf45a53ad85e",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 957,
"payload_entropy": 5.688656341132573,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3310,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.8,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "c37658bf143423d2a9d853c994f1d5f6e3297eff",
"event_fingerprint": "246b1e35b06807afb4a192784d31974e73231c0c",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6c8160595869adea51d6742918f57fdf",
"payload_hash": "2991de6d988a3c07358c56f665339369",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3310,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8ac6aec8183e2bbc596377b421e140135476bfd6",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 3310,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3310 \u00b7 (tentative d'exploit)",
"target_port_label": "3310 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3310,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 3310,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3310 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3310\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"target_port_label": "3310 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3310"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3310"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
15/07/2026 11:45:52 UTC
TCP
3310
—
Sonde port
Sonde port · port 3310 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3310
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 3310,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "2cb6c394742bd0192356a1643ceec8cc37256193",
"event_fingerprint": "abadc453fb643677108d8be56d3ad690816c3f18",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 3310,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6127bdb5e87f2ed0fb9bec2f830d63735ca2ca9f",
"protocol_details": {
"port": 3310
},
"attack_vector": "Sonde port \u00b7 port 3310 \u00b7 (sonde \/ probe)",
"target_port_label": "3310",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 3310,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 3310
},
"attack_vector": "Sonde port \u00b7 port 3310 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3310",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "3310"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}