Renseignement sur les menaces

Seychelles

160.119.71.4

FAI Alsycon B.V. Première vue 20/07/2026 00:35 UTC Dernière vue 20/07/2026 14:58 UTC Risque Moyen

Période analysée : 2026-06-20 → 2026-07-20

Activité suspecte — risque 64/100 (Moyen) — MITRE T1083 — confiance 100 % — via HTTP

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 64/100 Moyen

Première observation 20/07/2026 00:35 UTC

Dernière observation 20/07/2026 14:58 UTC

Événements (période) 6

MITRE ATT&CK principal T1083 5 occurrences

Activité suspecte — risque 64/100 (Moyen) — MITRE T1083 — confiance 100 % — via HTTP

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%

Confiance 100 % — Score WAF 100 · 4 tag(s) WAF

Comparaison ASN / FAI

ASN 49870 · 160.119.71.0/24 · AFRINIC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 6 événements sur la période pour cette IP.

160.119.71.136 Sonde port 20/07/2026 21:39 UTC
185.224.128.16 Sonde HTTP 20/07/2026 21:34 UTC
160.119.71.92 Sonde port 20/07/2026 21:24 UTC
160.119.71.135 Sonde port 20/07/2026 18:26 UTC
185.224.128.136 Sonde TLS 18/07/2026 18:51 UTC
160.119.76.7 Sonde port 1723/TCP 18/07/2026 05:26 UTC
160.119.71.9 grafana probe 13/07/2026 22:28 UTC
160.119.76.210 Sonde port 12/07/2026 18:12 UTC

Événements (filtres)

Première observation

20/07/2026 00:35 UTC

Dernière observation

20/07/2026 14:58 UTC

Dernière activité (filtres)

20/07/2026 14:58 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 5 HTTPS TCP 1

HTTP

HTTPS

Géolocalisation

Origine réseau déclarée

Seychelles unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Alsycon B.V. 0 Port 4430 config_file_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Chaîne d'attaque

Exploitation

Vecteur d'attaque

config file probe · via HTTP:4430 · (tentative d'exploit) · → /cgi-bin/luci/;stok=/locale

Détails protocole

Méthode: GET
Chemin: /cgi-bin/luci/;stok=/locale
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 S…

Aperçu payload

GET /cgi-bin/luci/;stok=/locale HTTP/1.1 Host: 62.3.50.33:4430 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi

Port / service

4430 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 100 % — 4 tag(s) WAF

Technique MITRE

T1083

Persona capteur

mail.sensor-1.internal

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

Http Sensitive Upstream Waf Score

Confiance

100%

Famille de menace

path_traversal config_leak_scan

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

6 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

6 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
20/07/2026 14:58:36 UTC	TCP	4430 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:4430 · (tentative d'exploit) · → /cgi-bin/luci/;stok=/locale	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /cgi-bin/luci/;stok=/locale UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 26 Recommandation Investiguer Tags 950324:rce-0 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /cgi-bin/luci/;stok=/locale TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 4430 Chemin / cible /cgi-bin/luci/;stok=/locale Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 4 tag(s) WAF Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Probe /cgi-bin/luci Ligne de requête `GET /cgi-bin/luci/;stok=/locale HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /cgi-bin/luci/;stok=/locale HTTP/1.1 Host: 62.3.50.33:4430 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi Requête brute (extrait) GET /cgi-bin/luci/;stok=/locale HTTP/1.1 Host: 62.3.50.33:4430 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Meta JSON brut { "http_header_count": 3, "http_query_params": 0, "http_path_depth": 4, "http_path_ext": null, "http_ua_hash": "7d8d41bb5252dcdaae44af38e2c1f406031b4d02", "http_host_hash": "9a80722c9efb5e5f2d11f77cb62c3d71cfc23a94", "http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 211, "payload_entropy": 5.341697594253851, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 4430, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.9, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25 }, "risk_score": 64, "tag_count": 7, "anomaly_count": 0, "campaign_key": "8207a2794a7baa29822179cf36a5b3d176ec26c7", "event_fingerprint": "c3dc2a919ee789004afb116d3cc7b4c09208c49d", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0245" ], "matched_pattern_names": [ "Probe \/cgi-bin\/luci" ], "pattern_ids": [ "pat-0245" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "8d3a4310782ed11654708481a971289b", "payload_hash": "52a289871280cf84b24501895c164baa", "path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc" }, "target_context": { "dst_port": 4430, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:4430\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "method": "GET", "path": "\/cgi-bin\/luci\/;stok=\/locale", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "waf_tags": [ "950324:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:4430\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:4430\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "evidence": { "method": "GET", "path": "\/cgi-bin\/luci\/;stok=\/locale", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "waf_tags": [ "950324:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:4430\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:4430\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0c27c1837f0a972f71cce855989db1fa5ab6e521", "protocol_details": { "http_method": "GET", "http_path": "\/cgi-bin\/luci\/;stok=\/locale", "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "port": 4430, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:4430\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "attack_vector": "config file probe \u00b7 via HTTP:4430 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/luci\/;stok=\/locale", "target_port_label": "4430 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 25, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 4430, "protocol_emulated": null, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/cgi-bin\/luci\/;stok=\/locale", "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "port": 4430, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:4430 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/luci\/;stok=\/locale", "evidence_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:4430\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "target_port_label": "4430 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "4430" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950324:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_cgi_bin", "http_sensitive_path", "iot_http_endpoint" ] }
20/07/2026 12:37:34 UTC	TCP	7443 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:7443 · (tentative d'exploit) · → /cgi-bin/luci/;stok=/locale	Élevée	Moyen · 61
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /cgi-bin/luci/;stok=/locale UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 26 Recommandation Investiguer Tags 950324:rce-0 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /cgi-bin/luci/;stok=/locale TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7443 Chemin / cible /cgi-bin/luci/;stok=/locale Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 61 Confiance : Confiance 100 % — 4 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Probe /cgi-bin/luci Ligne de requête `GET /cgi-bin/luci/;stok=/locale HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /cgi-bin/luci/;stok=/locale HTTP/1.1 Host: 62.3.50.33:7443 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi Requête brute (extrait) GET /cgi-bin/luci/;stok=/locale HTTP/1.1 Host: 62.3.50.33:7443 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 4, "http_path_ext": null, "http_ua_hash": "7d8d41bb5252dcdaae44af38e2c1f406031b4d02", "http_host_hash": "3207cc58a88e4dd65c61f1b1f14e699cc0722bbe", "http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 211, "payload_entropy": 5.3492503337961885, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 7443, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.3, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 61, "tag_count": 8, "anomaly_count": 0, "campaign_key": "d804284d58e5461999ca6f65a85eee8c006a68af", "event_fingerprint": "4cfb3f9a88e86a80b69f55866567d96ef80859ec", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0245" ], "matched_pattern_names": [ "Probe \/cgi-bin\/luci" ], "pattern_ids": [ "pat-0245" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 61 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "8d3a4310782ed11654708481a971289b", "payload_hash": "800c978b75f14fb46d752589d1fc5f43", "path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc" }, "target_context": { "dst_port": 7443, "service": "http", "service_name": "http", "risk_score": 61 }, "payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "method": "GET", "path": "\/cgi-bin\/luci\/;stok=\/locale", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "waf_tags": [ "950324:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "evidence": { "method": "GET", "path": "\/cgi-bin\/luci\/;stok=\/locale", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "waf_tags": [ "950324:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b05fcb259b619ab4c6cc02b1ce37ee13e1364018", "protocol_details": { "http_method": "GET", "http_path": "\/cgi-bin\/luci\/;stok=\/locale", "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "port": 7443, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "attack_vector": "config file probe \u00b7 via HTTP:7443 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/luci\/;stok=\/locale", "target_port_label": "7443 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 61 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 61, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 7443, "protocol_emulated": true, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/cgi-bin\/luci\/;stok=\/locale", "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "port": 7443, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:7443 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/luci\/;stok=\/locale", "evidence_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:7443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "target_port_label": "7443 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "7443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950324:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_cgi_bin", "http_sensitive_path", "iot_http_endpoint", "net_web_probe" ] }
20/07/2026 11:29:06 UTC	TCP	8081 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:8081 · (tentative d'exploit) · → /cgi-bin/luci/;stok=/locale	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /cgi-bin/luci/;stok=/locale UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 26 Recommandation Investiguer Tags 950324:rce-0 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /cgi-bin/luci/;stok=/locale TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8081 Chemin / cible /cgi-bin/luci/;stok=/locale Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 4 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Probe /cgi-bin/luci Ligne de requête `GET /cgi-bin/luci/;stok=/locale HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /cgi-bin/luci/;stok=/locale HTTP/1.1 Host: 62.3.50.33:8081 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi Requête brute (extrait) GET /cgi-bin/luci/;stok=/locale HTTP/1.1 Host: 62.3.50.33:8081 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 4, "http_path_ext": null, "http_ua_hash": "7d8d41bb5252dcdaae44af38e2c1f406031b4d02", "http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24", "http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 211, "payload_entropy": 5.366830930689774, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8081, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.2, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 64, "tag_count": 8, "anomaly_count": 0, "campaign_key": "3d40e968e9c11636e8bb0175e059eccbf14062f5", "event_fingerprint": "c2c94bf001945a421d3aac95244702301dde0690", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0245" ], "matched_pattern_names": [ "Probe \/cgi-bin\/luci" ], "pattern_ids": [ "pat-0245" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 64 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "8d3a4310782ed11654708481a971289b", "payload_hash": "97209e76a5d64c9f1c1622a719ca9c11", "path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc" }, "target_context": { "dst_port": 8081, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "method": "GET", "path": "\/cgi-bin\/luci\/;stok=\/locale", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "waf_tags": [ "950324:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "evidence": { "method": "GET", "path": "\/cgi-bin\/luci\/;stok=\/locale", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "waf_tags": [ "950324:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fd027ff9d3d5c8a42a654fc064ec4b40413b8d1b", "protocol_details": { "http_method": "GET", "http_path": "\/cgi-bin\/luci\/;stok=\/locale", "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/luci\/;stok=\/locale", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8081, "protocol_emulated": true, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/cgi-bin\/luci\/;stok=\/locale", "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "port": 8081, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/luci\/;stok=\/locale", "evidence_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "target_port_label": "8081 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8081" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950324:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_cgi_bin", "http_sensitive_path", "iot_http_endpoint", "net_web_probe" ] }
20/07/2026 04:46:51 UTC	TCP	8888 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:8888 · (tentative d'exploit) · → /cgi-bin/luci/;stok=/locale	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /cgi-bin/luci/;stok=/locale UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 26 Recommandation Investiguer Tags 950324:rce-0 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /cgi-bin/luci/;stok=/locale TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8888 Chemin / cible /cgi-bin/luci/;stok=/locale Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 4 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Probe /cgi-bin/luci HTTP alt 8888 probe Ligne de requête `GET /cgi-bin/luci/;stok=/locale HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /cgi-bin/luci/;stok=/locale HTTP/1.1 Host: 62.3.50.33:8888 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi Requête brute (extrait) GET /cgi-bin/luci/;stok=/locale HTTP/1.1 Host: 62.3.50.33:8888 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 4, "http_path_ext": null, "http_ua_hash": "7d8d41bb5252dcdaae44af38e2c1f406031b4d02", "http_host_hash": "25a58e7d7f0ed40aadf0d51b038172ea9ccc8435", "http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 211, "payload_entropy": 5.377488040052272, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8888, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.3, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 64, "tag_count": 8, "anomaly_count": 0, "campaign_key": "e603fb41046a844bb38bbdbfe2765785b5b06c4c", "event_fingerprint": "5a49af6bb19f1dd917b679e38d2b698de98cf79a", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0245", "pat-0599" ], "matched_pattern_names": [ "Probe \/cgi-bin\/luci", "HTTP alt 8888 probe" ], "pattern_ids": [ "pat-0245", "pat-0599" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 64 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "8d3a4310782ed11654708481a971289b", "payload_hash": "959fe142c7874c50e63b20bd90bbbbd4", "path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc" }, "target_context": { "dst_port": 8888, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "method": "GET", "path": "\/cgi-bin\/luci\/;stok=\/locale", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "waf_tags": [ "950324:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "evidence": { "method": "GET", "path": "\/cgi-bin\/luci\/;stok=\/locale", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "waf_tags": [ "950324:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0f2f052752e81bd5edccd3621117a260a86120ea", "protocol_details": { "http_method": "GET", "http_path": "\/cgi-bin\/luci\/;stok=\/locale", "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "attack_vector": "config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/luci\/;stok=\/locale", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8888, "protocol_emulated": true, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/cgi-bin\/luci\/;stok=\/locale", "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "port": 8888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:8888 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/luci\/;stok=\/locale", "evidence_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8888\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "target_port_label": "8888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950324:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_cgi_bin", "http_sensitive_path", "iot_http_endpoint", "net_web_probe" ] }
20/07/2026 04:36:22 UTC	TCP	8443 · HTTPS	https	Botnet Mozi mozi pattern · via HTTPS:8443 · (commande & contrôle)	Élevée	Faible · 36
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port http_get_probe mozi_pattern net_web_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8443 Chemin / cible — Service HTTPS Payload GET /cgi-bin/luci/;stok=/locale HTTP/1.1 Host: 62.3.50.33:8443 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 36 Confiance : Confiance 0 % — 4 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0011 Tactiques MITRE TA0011 User-Agent — Règles WAF — Payload (extrait) GET /cgi-bin/luci/;stok=/locale HTTP/1.1 Host: 62.3.50.33:8443 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi Requête brute (extrait) GET /cgi-bin/luci/;stok=/locale HTTP/1.1 Host: 62.3.50.33:8443 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 211, "payload_entropy": 5.362306672669002, "port_category": "registered", "org": "Alsycon B.V.", "service": "https", "app_proto": "https", "asn": 49870, "country": "SC", "dst_port": 8443, "risk_waf": 8, "risk_classification": 82, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 3.2, "risk_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 36, "tag_count": 4, "anomaly_count": 0, "campaign_key": "2aa17a6b515596b20eaea8d57184d62da9f48dfc", "event_fingerprint": "48aa5a12dd4150e072f6d3dd03f9143ac67f8d69", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 36 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5e083e49eb70020692b302d245e30487", "path_pattern_hash": "762d384fab941f6d0c2239f19994f30e" }, "target_context": { "dst_port": 8443, "service": "https", "service_name": "https", "risk_score": 36 }, "payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "evidence": { "request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6af6301379cd1a799a3e3c0a84161ff539fdc1a5", "protocol_details": { "payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "port": 8443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "attack_vector": "mozi pattern \u00b7 via HTTPS:8443 \u00b7 (commande & contr\u00f4le)", "target_port_label": "8443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 via HTTPS", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 36 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 36, "risk_label": "Faible", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 8443, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "port": 8443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "mozi pattern \u00b7 via HTTPS:8443 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "target_port_label": "8443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "8443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "http_get_probe", "mozi_pattern", "net_web_probe" ] }
20/07/2026 00:35:12 UTC	TCP	8080 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:8080 · (tentative d'exploit) · → /cgi-bin/luci/;stok=/locale	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1083 TA0001 TA0002 Protocole GET /cgi-bin/luci/;stok=/locale UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 26 Recommandation Investiguer Tags 950324:rce-0 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /cgi-bin/luci/;stok=/locale TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8080 Chemin / cible /cgi-bin/luci/;stok=/locale Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Risque capteur Moyen · 64 Confiance : Confiance 100 % — 4 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Probe /cgi-bin/luci Ligne de requête `GET /cgi-bin/luci/;stok=/locale HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /cgi-bin/luci/;stok=/locale HTTP/1.1 Host: 62.3.50.33:8080 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi Requête brute (extrait) GET /cgi-bin/luci/;stok=/locale HTTP/1.1 Host: 62.3.50.33:8080 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 3, "http_query_params": 0, "http_path_depth": 4, "http_path_ext": null, "http_ua_hash": "7d8d41bb5252dcdaae44af38e2c1f406031b4d02", "http_host_hash": "c9908f9a31aefa5902e21ee9fa132cbe056c536d", "http_target_hash": "3f4fd23fac2339b9630dca2c095face2237d0162", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 211, "payload_entropy": 5.363848985272283, "port_category": "registered", "org": "Alsycon B.V.", "service": "http", "app_proto": "http", "asn": 49870, "country": "SC", "dst_port": 8080, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 64, "tag_count": 8, "anomaly_count": 0, "campaign_key": "7b1bd70282efa0efd6aa84cdf663a34a1e7dae33", "event_fingerprint": "6f2692bc71908c56e183d9937a18352a18a5c092", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0245" ], "matched_pattern_names": [ "Probe \/cgi-bin\/luci" ], "pattern_ids": [ "pat-0245" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 64 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "SC", "asn": 49870, "org": "Alsycon B.V.", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "8d3a4310782ed11654708481a971289b", "payload_hash": "9dc51d1839623dce61d1ccc5ff4cf522", "path_pattern_hash": "8a67851ae571c21e82f4f47991b30bcc" }, "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "method": "GET", "path": "\/cgi-bin\/luci\/;stok=\/locale", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "waf_tags": [ "950324:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "evidence": { "method": "GET", "path": "\/cgi-bin\/luci\/;stok=\/locale", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "waf_tags": [ "950324:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "request_sample": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4197c1e5d384e556b96cd97d01d503348f905ecd", "protocol_details": { "http_method": "GET", "http_path": "\/cgi-bin\/luci\/;stok=\/locale", "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/luci\/;stok=\/locale", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 64 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "GET", "http_path": "\/cgi-bin\/luci\/;stok=\/locale", "request_line": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/141.0.0.0 Safari\/537.36", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:8080 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/luci\/;stok=\/locale", "evidence_snippet": "GET \/cgi-bin\/luci\/;stok=\/locale HTTP\/1.1\r\nHost: 62.3.50.33:8080\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950324:rce-0", "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_cgi_bin", "http_sensitive_path", "iot_http_endpoint", "net_web_probe" ] }

Réputation

Sécurité avancée

Offensive / Recon

Sécurité

DNS

Réseau

E-mail

IP

Utilitaires

160.119.71.4

Profil de menace

Pourquoi listée

Comparaison ASN / FAI

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

160.119.71.4

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence