16/07/2026 15:45:06 UTC
TCP
9999 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:9999 · (tentative d'exploit) · → /_next
Élevée
Élevé · 74
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007;…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9999
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 74
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:9999
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 14;
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:9999 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1978af5307537775fab4b66b0f1439319be37ce1",
"http_host_hash": "83a22baaf629d53e39c79d30e6b18dca9da1a92c",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 989,
"payload_entropy": 5.671778040381388,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 9999,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 74,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "eb8e8c06490b9f5ada178c35ce58bc04a24a8999",
"event_fingerprint": "15fcd1e769f7f8e4336ac9ca5139e04ee407871c",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7967be4fa492cfad4b86b41e3ae090e9",
"payload_hash": "5b79c18818bec437c08eac5027366ba6",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 9999,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "222c4be2adf687a887b64f84924b0d968dfde0b5",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 9999,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"attack_vector": "http smuggling probe \u00b7 via HTTP:9999 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "9999 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9999,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 9999,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:9999 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"target_port_label": "9999 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9999"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"admin-alt",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 15:45:04 UTC
TCP
9999 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:9999 · (tentative d'exploit)
Élevée
Élevé · 74
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007;…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9999
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 74
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:9999
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:9999 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36 A
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "1978af5307537775fab4b66b0f1439319be37ce1",
"http_host_hash": "83a22baaf629d53e39c79d30e6b18dca9da1a92c",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 985,
"payload_entropy": 5.6770129917869525,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 9999,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 74,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "f8a2905ca6eb68b91de48a21e2a8e470a8bfb35c",
"event_fingerprint": "92d195e6438958b9e0e70bfcb8bc76404ddff1e8",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7967be4fa492cfad4b86b41e3ae090e9",
"payload_hash": "f2aadf560bf43a595658a0eb3b53a097",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9999,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36\r\nA",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36\r\nA",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5eff66c07517399bd1755247d1fab3906eaf4d56",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 9999,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F",
"attack_vector": "http smuggling probe \u00b7 via HTTP:9999 \u00b7 (tentative d'exploit)",
"target_port_label": "9999 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9999,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 9999,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:9999 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F",
"target_port_label": "9999 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9999"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"admin-alt",
"http"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 15:45:03 UTC
TCP
9999 · ADMIN ALT
admin-alt
admin-alt · via ADMIN ALT:9999 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
ADMIN-ALT
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9999
Chemin / cible
—
Pourquoi cette classification : Type « admin-alt » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "admin-alt",
"app_proto": "admin-alt",
"asn": 49870,
"country": "SC",
"dst_port": 9999,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "206c95a9eb725a1fc21f04db3e4cf4233b894a69",
"event_fingerprint": "bdae3a5e708dccdbe307a2861747dd09885f206a",
"classification_reason": "Type \u00ab admin-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "admin-alt",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "d3aaa0a3d94e4e5a70802f7b7e17f9f7"
},
"target_context": {
"dst_port": 9999,
"service": "admin-alt",
"service_name": "admin-alt",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ce048627091cf43bcf12b483a4838949c5be7f0",
"protocol_details": {
"port": 9999,
"service": "admin-alt",
"service_label_fr": "ADMIN ALT"
},
"attack_vector": "admin-alt \u00b7 via ADMIN ALT:9999 \u00b7 (sonde \/ probe)",
"target_port_label": "9999 \u00b7 ADMIN ALT",
"emulator_service": "admin-alt",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab admin-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab admin-alt \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "admin-alt",
"service_label_fr": "ADMIN ALT",
"dst_port": 9999,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-admin-alt",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 9999,
"service": "admin-alt",
"service_label_fr": "ADMIN ALT"
},
"attack_vector": "admin-alt \u00b7 via ADMIN ALT:9999 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "9999 \u00b7 ADMIN ALT",
"emulator_service": "admin-alt",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "admin_alt",
"service_banner": "honeypot-admin-alt",
"service_os": "linux",
"dst_port": "9999"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
16/07/2026 15:12:09 UTC
TCP
3210 · SAP Diag
Sonde HTTP smuggling
http smuggling probe · via SAP Diag:3210 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_sap_diag_probe
sap_diag_emulated
sap_diag_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3210
Chemin / cible
—
Service
SAP Diag
Payload
POST /api/route HTTP/1.1 Host: 62.3.50.33:3210 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:3210
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:3210 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Ne
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000000534150000000000000000000000000",
"emulator_response_len": 19,
"bytes_in": 927,
"payload_entropy": 5.654074729405261,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 49870,
"country": "SC",
"dst_port": 3210,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 25
},
"risk_score": 52,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "fb40fa2afc1610707a648ee62f358b01d0ad9a8d",
"event_fingerprint": "fa1d8ffeefe2824f1772a5579e5d384fc5982096",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 25,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7bf83fcc5504951b63e30a42e8ac78a0",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 3210,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 52
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Ne",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"evidence": {
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Ne",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c0ab44bb24986a2a2e5f4f71cf206800e5cda283",
"protocol_details": {
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"port": 3210,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"attack_vector": "http smuggling probe \u00b7 via SAP Diag:3210 \u00b7 (tentative d'exploit)",
"target_port_label": "3210 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via SAP Diag",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 25,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 3210,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"port": 3210,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "http smuggling probe \u00b7 via SAP Diag:3210 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"target_port_label": "3210 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "3210"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_sap_diag_probe",
"sap_diag_emulated",
"sap_diag_payload",
"sap_diag_probe"
]
}
16/07/2026 15:12:08 UTC
TCP
3210 · SAP Diag
Sonde HTTP smuggling
http smuggling probe · via SAP Diag:3210 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_sap_diag_probe
sap_diag_emulated
sap_diag_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3210
Chemin / cible
—
Service
SAP Diag
Payload
POST /_next/server HTTP/1.1 Host: 62.3.50.33:3210 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Windows NT
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:3210
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Windows NT
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:3210 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Ac
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000000534150000000000000000000000000",
"emulator_response_len": 19,
"bytes_in": 946,
"payload_entropy": 5.643793574855232,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 49870,
"country": "SC",
"dst_port": 3210,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 25
},
"risk_score": 52,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "fb40fa2afc1610707a648ee62f358b01d0ad9a8d",
"event_fingerprint": "fa1d8ffeefe2824f1772a5579e5d384fc5982096",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 25,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1f73de38f1830741814e54c5fa48251f",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 3210,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 52
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT ",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Ac",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"evidence": {
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Ac",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "70e77f85f298b3528cb848200468bf443f9e5ea6",
"protocol_details": {
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"port": 3210,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"attack_vector": "http smuggling probe \u00b7 via SAP Diag:3210 \u00b7 (tentative d'exploit)",
"target_port_label": "3210 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via SAP Diag",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 25,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 3210,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"port": 3210,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "http smuggling probe \u00b7 via SAP Diag:3210 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"target_port_label": "3210 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "3210"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_sap_diag_probe",
"sap_diag_emulated",
"sap_diag_payload",
"sap_diag_probe"
]
}
16/07/2026 15:12:08 UTC
TCP
3210 · SAP Diag
Sonde HTTP smuggling
http smuggling probe · via SAP Diag:3210 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_sap_diag_probe
sap_diag_emulated
sap_diag_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3210
Chemin / cible
—
Service
SAP Diag
Payload
POST /app HTTP/1.1 Host: 62.3.50.33:3210 Content-Length: 508 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:3210
Content-Length: 508
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; Android 4.
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:3210 Content-Length: 508 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gzip, de
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000000534150000000000000000000000000",
"emulator_response_len": 19,
"bytes_in": 947,
"payload_entropy": 5.672199028131071,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 49870,
"country": "SC",
"dst_port": 3210,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 25
},
"risk_score": 52,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "fb40fa2afc1610707a648ee62f358b01d0ad9a8d",
"event_fingerprint": "fa1d8ffeefe2824f1772a5579e5d384fc5982096",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 25,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0fb81ce2587488a1122ae87a70121bfc",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 3210,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 52
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, de",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"evidence": {
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, de",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f4212d8b13e9e69bd36a629fba9753d44166109b",
"protocol_details": {
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"port": 3210,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"attack_vector": "http smuggling probe \u00b7 via SAP Diag:3210 \u00b7 (tentative d'exploit)",
"target_port_label": "3210 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via SAP Diag",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 25,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 3210,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"port": 3210,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "http smuggling probe \u00b7 via SAP Diag:3210 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"target_port_label": "3210 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "3210"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_sap_diag_probe",
"sap_diag_emulated",
"sap_diag_payload",
"sap_diag_probe"
]
}
16/07/2026 15:12:06 UTC
TCP
3210 · SAP Diag
Sonde HTTP smuggling
http smuggling probe · via SAP Diag:3210 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_sap_diag_probe
sap_diag_emulated
sap_diag_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3210
Chemin / cible
—
Service
SAP Diag
Payload
POST /api HTTP/1.1 Host: 62.3.50.33:3210 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:3210
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:3210 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, deflate Ne
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000000534150000000000000000000000000",
"emulator_response_len": 19,
"bytes_in": 952,
"payload_entropy": 5.661746574192346,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 49870,
"country": "SC",
"dst_port": 3210,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 25
},
"risk_score": 52,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "fb40fa2afc1610707a648ee62f358b01d0ad9a8d",
"event_fingerprint": "fa1d8ffeefe2824f1772a5579e5d384fc5982096",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 25,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2061ca58ca62871519d085e49ac21444",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 3210,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 52
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nNe",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nNe",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fbea980cce23528fc42cb00f9f2b828833e43dfd",
"protocol_details": {
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"port": 3210,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "http smuggling probe \u00b7 via SAP Diag:3210 \u00b7 (tentative d'exploit)",
"target_port_label": "3210 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via SAP Diag",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 25,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 3210,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"port": 3210,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "http smuggling probe \u00b7 via SAP Diag:3210 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "3210 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "3210"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_sap_diag_probe",
"sap_diag_emulated",
"sap_diag_payload",
"sap_diag_probe"
]
}
16/07/2026 15:12:05 UTC
TCP
3210 · SAP Diag
Sonde HTTP smuggling
http smuggling probe · via SAP Diag:3210 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_sap_diag_probe
sap_diag_emulated
sap_diag_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3210
Chemin / cible
—
Service
SAP Diag
Payload
POST /_next HTTP/1.1 Host: 62.3.50.33:3210 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; W
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:3210
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; W
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:3210 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: poop1234
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000000534150000000000000000000000000",
"emulator_response_len": 19,
"bytes_in": 914,
"payload_entropy": 5.603542613537632,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 49870,
"country": "SC",
"dst_port": 3210,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 25
},
"risk_score": 52,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "fb40fa2afc1610707a648ee62f358b01d0ad9a8d",
"event_fingerprint": "fa1d8ffeefe2824f1772a5579e5d384fc5982096",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 25,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c4b3375dd17d7db5a81e7811d3e742fd",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 3210,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 52
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"evidence": {
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bf51ad968c87d0fae2a3f2352ffedc814da0238e",
"protocol_details": {
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"port": 3210,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"attack_vector": "http smuggling probe \u00b7 via SAP Diag:3210 \u00b7 (tentative d'exploit)",
"target_port_label": "3210 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via SAP Diag",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 25,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 3210,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"port": 3210,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "http smuggling probe \u00b7 via SAP Diag:3210 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"target_port_label": "3210 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "3210"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_sap_diag_probe",
"sap_diag_emulated",
"sap_diag_payload",
"sap_diag_probe"
]
}
16/07/2026 15:12:04 UTC
TCP
3210 · SAP Diag
Sonde HTTP smuggling
http smuggling probe · via SAP Diag:3210 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_sap_diag_probe
sap_diag_emulated
sap_diag_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3210
Chemin / cible
—
Service
SAP Diag
Payload
POST / HTTP/1.1 Host: 62.3.50.33:3210 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWM
Pourquoi cette classification : Connexion SAP Diag/GUI · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:3210
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWM
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:3210 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36 Accept-Enco
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000000534150000000000000000000000000",
"emulator_response_len": 19,
"bytes_in": 974,
"payload_entropy": 5.6636028157991545,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 49870,
"country": "SC",
"dst_port": 3210,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 25,
"risk_boost": 20,
"risk_granularity": 4.5,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 25
},
"risk_score": 52,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "fb40fa2afc1610707a648ee62f358b01d0ad9a8d",
"event_fingerprint": "fa1d8ffeefe2824f1772a5579e5d384fc5982096",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 25,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dcfed9173743fceec1619b904c37c313",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 3210,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 52
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-Enco",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"evidence": {
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-Enco",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d0a4ab195e1ef0a379d029280872a0018ce01946",
"protocol_details": {
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"port": 3210,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"attack_vector": "http smuggling probe \u00b7 via SAP Diag:3210 \u00b7 (tentative d'exploit)",
"target_port_label": "3210 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
"classification_reason_label_fr": "Connexion SAP Diag\/GUI \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via SAP Diag",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 25,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 3210,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"port": 3210,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "http smuggling probe \u00b7 via SAP Diag:3210 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3210\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"target_port_label": "3210 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "3210"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_sap_diag_probe",
"sap_diag_emulated",
"sap_diag_payload",
"sap_diag_probe"
]
}
16/07/2026 15:12:03 UTC
TCP
3210 · SAP Diag
Sonde SAP Diag/GUI
Sonde SAP Diag/GUI · via SAP Diag:3210 · (sonde / probe)
Élevée
Faible · 24
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SAP-DIAG
WAF
—
Recommandation
Surveiller
Tags
net_sap_diag_probe
sap_diag_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3210
Chemin / cible
—
Pourquoi cette classification : Type « sap_diag_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "00000000534150000000000000000000000000",
"emulator_response_len": 19,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "sap-diag",
"app_proto": "sap-diag",
"asn": 49870,
"country": "SC",
"dst_port": 3210,
"risk_waf": 8,
"risk_classification": 62,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 38,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.4,
"risk_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 0
},
"risk_score": 24,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "4bf30ff5e810f8fc90f0bb03617a336555f78e1b",
"event_fingerprint": "fa1d8ffeefe2824f1772a5579e5d384fc5982096",
"classification_reason": "Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 0,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "sap-diag",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "b1c7373ffa4daadb6ab138f759082d87"
},
"target_context": {
"dst_port": 3210,
"service": "sap-diag",
"service_name": "sap-diag",
"risk_score": 24
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"sap_probe"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "80e2ae49f1c30085b660ba1496a8a0ab5a29cd9c",
"protocol_details": {
"port": 3210,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3210 \u00b7 (sonde \/ probe)",
"target_port_label": "3210 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab sap_diag_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 62,
"behavior": 0,
"geo": 0,
"protocol": 38,
"novelty": 0,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "sap-diag",
"service_label_fr": "SAP Diag",
"dst_port": 3210,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-diag",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 3210,
"service": "sap-diag",
"service_label_fr": "SAP Diag"
},
"attack_vector": "Sonde SAP Diag\/GUI \u00b7 via SAP Diag:3210 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3210 \u00b7 SAP Diag",
"emulator_service": "sap-diag",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_diag",
"service_banner": "honeypot-sap-diag",
"service_os": "linux",
"dst_port": "3210"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_sap_diag_probe",
"sap_diag_emulated"
]
}
16/07/2026 14:55:06 UTC
TCP
5001 · UPNP TCP
Sonde HTTP smuggling
http smuggling probe · via UPNP TCP:5001 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
POST /api/route HTTP/1.1 Host: 62.3.50.33:5001 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; Android
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:5001
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:5001 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 948,
"payload_entropy": 5.6427087152237325,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 49870,
"country": "SC",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "074b6b31ed3a8c5490682064a956f96ee16a85d5",
"event_fingerprint": "c4fbc45603d24d7eb870e14692e418def7cee731",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f3e63be7b1e8f455f5c509622958bdd3",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 52
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"evidence": {
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fa51c9b215a4f0b8a72ca75eefce98f174cd170e",
"protocol_details": {
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"attack_vector": "http smuggling probe \u00b7 via UPNP TCP:5001 \u00b7 (tentative d'exploit)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via UPNP TCP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "http smuggling probe \u00b7 via UPNP TCP:5001 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
16/07/2026 14:55:05 UTC
TCP
5001 · UPNP TCP
Sonde HTTP smuggling
http smuggling probe · via UPNP TCP:5001 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
POST /_next/server HTTP/1.1 Host: 62.3.50.33:5001 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Andr
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:5001
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; Andr
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:5001 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Ne
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 958,
"payload_entropy": 5.656100805324046,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 49870,
"country": "SC",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "074b6b31ed3a8c5490682064a956f96ee16a85d5",
"event_fingerprint": "c4fbc45603d24d7eb870e14692e418def7cee731",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a08773f94873395711f1c3324fafba23",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 52
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNe",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"evidence": {
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNe",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "667ca84495a3fb7b9e687a1581cfd5ca4c2ceab2",
"protocol_details": {
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"attack_vector": "http smuggling probe \u00b7 via UPNP TCP:5001 \u00b7 (tentative d'exploit)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via UPNP TCP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "http smuggling probe \u00b7 via UPNP TCP:5001 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
16/07/2026 14:55:05 UTC
TCP
5001 · UPNP TCP
Sonde HTTP smuggling
http smuggling probe · via UPNP TCP:5001 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
POST /app HTTP/1.1 Host: 62.3.50.33:5001 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:5001
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:5001 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, deflate Ne
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 958,
"payload_entropy": 5.650449379021956,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 49870,
"country": "SC",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "074b6b31ed3a8c5490682064a956f96ee16a85d5",
"event_fingerprint": "c4fbc45603d24d7eb870e14692e418def7cee731",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "01a1cea57af43a569e4b0fb155774aed",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 52
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nNe",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nNe",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "116dcca477236f627fdf378ca5e21051ffa5c0af",
"protocol_details": {
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "http smuggling probe \u00b7 via UPNP TCP:5001 \u00b7 (tentative d'exploit)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via UPNP TCP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "http smuggling probe \u00b7 via UPNP TCP:5001 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
16/07/2026 14:55:03 UTC
TCP
5001 · UPNP TCP
Sonde HTTP smuggling
http smuggling probe · via UPNP TCP:5001 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
POST /api HTTP/1.1 Host: 62.3.50.33:5001 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:5001
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; Android 4.
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:5001 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gzip, de
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 961,
"payload_entropy": 5.694789782026815,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 49870,
"country": "SC",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "074b6b31ed3a8c5490682064a956f96ee16a85d5",
"event_fingerprint": "c4fbc45603d24d7eb870e14692e418def7cee731",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f5fbc2a437dfc823f8e5912ae01eb179",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 52
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, de",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"evidence": {
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, de",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3fdf58f0e174c50cad041e3f20ba38ea30e2acaa",
"protocol_details": {
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"attack_vector": "http smuggling probe \u00b7 via UPNP TCP:5001 \u00b7 (tentative d'exploit)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via UPNP TCP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "http smuggling probe \u00b7 via UPNP TCP:5001 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
16/07/2026 14:55:02 UTC
TCP
5001 · UPNP TCP
Sonde HTTP smuggling
http smuggling probe · via UPNP TCP:5001 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
POST /_next HTTP/1.1 Host: 62.3.50.33:5001 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10;
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:5001
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 10;
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:5001 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-Acti
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 945,
"payload_entropy": 5.6624815647193625,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 49870,
"country": "SC",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "074b6b31ed3a8c5490682064a956f96ee16a85d5",
"event_fingerprint": "c4fbc45603d24d7eb870e14692e418def7cee731",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "243942490f40b4df911dc50b9cbf70ab",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 52
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Acti",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;",
"evidence": {
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Acti",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5f1d7d93918bb69dc97ca2278c818754fb18b739",
"protocol_details": {
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;",
"attack_vector": "http smuggling probe \u00b7 via UPNP TCP:5001 \u00b7 (tentative d'exploit)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via UPNP TCP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "http smuggling probe \u00b7 via UPNP TCP:5001 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
16/07/2026 14:55:01 UTC
TCP
5001 · UPNP TCP
upnp-tcp
upnp-tcp · via UPNP TCP:5001 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5001
Chemin / cible
—
Pourquoi cette classification : Type « upnp-tcp » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 49870,
"country": "SC",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "8ca151c027112eabf74d29fbbddc8c03689ed5c3",
"event_fingerprint": "a80d71c7dcef6b8541bd0810036e78213dbbe720",
"classification_reason": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "0dc6bbf1117b9a1ab96b1de856cf3e22"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0dcb90c621fcb924b8f5810b858cb3662262766d",
"protocol_details": {
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "upnp-tcp \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab upnp-tcp \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "upnp-tcp \u00b7 via UPNP TCP:5001 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
16/07/2026 14:55:01 UTC
TCP
5001 · UPNP TCP
Sonde HTTP smuggling
http smuggling probe · via UPNP TCP:5001 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
UPNP-TCP
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5001
Chemin / cible
—
Service
UPNP TCP
Payload
POST / HTTP/1.1 Host: 62.3.50.33:5001 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:5001
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:5001 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gzip, defla
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a",
"emulator_response_len": 39,
"bytes_in": 958,
"payload_entropy": 5.662663014206063,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "upnp-tcp",
"app_proto": "upnp-tcp",
"asn": 49870,
"country": "SC",
"dst_port": 5001,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.3,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "074b6b31ed3a8c5490682064a956f96ee16a85d5",
"event_fingerprint": "c4fbc45603d24d7eb870e14692e418def7cee731",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "upnp-tcp",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bb1d99250b9d0650b3fadd976769ec41",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 5001,
"service": "upnp-tcp",
"service_name": "upnp-tcp",
"risk_score": 52
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"evidence": {
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "962132f7c13bf2176fe9296bd5d7f1295a3f8be3",
"protocol_details": {
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"attack_vector": "http smuggling probe \u00b7 via UPNP TCP:5001 \u00b7 (tentative d'exploit)",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via UPNP TCP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "upnp-tcp",
"service_label_fr": "UPNP TCP",
"dst_port": 5001,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-upnp-tcp",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"port": 5001,
"service": "upnp-tcp",
"service_label_fr": "UPNP TCP"
},
"attack_vector": "http smuggling probe \u00b7 via UPNP TCP:5001 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"target_port_label": "5001 \u00b7 UPNP TCP",
"emulator_service": "upnp-tcp",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "upnp_tcp",
"service_banner": "honeypot-upnp-tcp",
"service_os": "linux",
"dst_port": "5001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
16/07/2026 14:27:20 UTC
TCP
9443 · HTTPS
Sonde HTTP smuggling
http smuggling probe · via HTTPS:9443 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Investiguer
Tags
http_alt_port
mozi_pattern
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
POST /app HTTP/1.1 Host: 62.3.50.33:9443 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:9443
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:9443 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 938,
"payload_entropy": 5.621687148552222,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "https",
"app_proto": "https",
"asn": 49870,
"country": "SC",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f4665abecd058e1884fa8dd4266c591b080098e9",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0600"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0842",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7cb2f1a5bbd8ee3c28527cee6d35284b",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 52
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "013012a0e782e18a3cc919b7b4c9513fde5c5b2c",
"protocol_details": {
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "http smuggling probe \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTPS",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http smuggling probe \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"http_alt_port",
"mozi_pattern",
"net_web_probe",
"websphere_probe"
]
}
16/07/2026 14:27:20 UTC
TCP
9443 · HTTPS
Sonde HTTP smuggling
http smuggling probe · via HTTPS:9443 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Investiguer
Tags
http_alt_port
mozi_pattern
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
POST /api/route HTTP/1.1 Host: 62.3.50.33:9443 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:9443
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:9443 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: poop1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 911,
"payload_entropy": 5.628150755927822,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "https",
"app_proto": "https",
"asn": 49870,
"country": "SC",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f4665abecd058e1884fa8dd4266c591b080098e9",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0600"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0842",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fe4e5046ba9b9b8237cb7902458caddf",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 52
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"evidence": {
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "005c91e052c8c47db50eb88ac06fd7ff5820b5ff",
"protocol_details": {
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"attack_vector": "http smuggling probe \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTPS",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http smuggling probe \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"http_alt_port",
"mozi_pattern",
"net_web_probe",
"websphere_probe"
]
}
16/07/2026 14:27:19 UTC
TCP
9443 · HTTPS
Sonde HTTP smuggling
http smuggling probe · via HTTPS:9443 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Investiguer
Tags
http_alt_port
mozi_pattern
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
POST /_next/server HTTP/1.1 Host: 62.3.50.33:9443 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Macintosh;
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:9443
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Macintosh;
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:9443 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate N
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 953,
"payload_entropy": 5.657926909773476,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "https",
"app_proto": "https",
"asn": 49870,
"country": "SC",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f4665abecd058e1884fa8dd4266c591b080098e9",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0600"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0842",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f0d52a67eefae7bd54d8d8aea91b7ab9",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 52
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; ",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"evidence": {
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2890e09863f8afe69171c49270cad62241d6d3ed",
"protocol_details": {
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"attack_vector": "http smuggling probe \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTPS",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http smuggling probe \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"http_alt_port",
"mozi_pattern",
"net_web_probe",
"websphere_probe"
]
}
16/07/2026 14:27:18 UTC
TCP
9443 · HTTPS
Sonde HTTP smuggling
http smuggling probe · via HTTPS:9443 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Investiguer
Tags
http_alt_port
mozi_pattern
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
POST /api HTTP/1.1 Host: 62.3.50.33:9443 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 145
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:9443
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 145
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:9443 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 937,
"payload_entropy": 5.65246948121383,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "https",
"app_proto": "https",
"asn": 49870,
"country": "SC",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f4665abecd058e1884fa8dd4266c591b080098e9",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0600"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0842",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c887528ec08838cfef0208a7cd0afc7e",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 52
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"evidence": {
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d980519f310fa00b8b61754fb22e2db8574c7c25",
"protocol_details": {
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"attack_vector": "http smuggling probe \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTPS",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http smuggling probe \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"http_alt_port",
"mozi_pattern",
"net_web_probe",
"websphere_probe"
]
}
16/07/2026 14:27:16 UTC
TCP
9443 · HTTPS
Sonde HTTP smuggling
http smuggling probe · via HTTPS:9443 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Investiguer
Tags
http_alt_port
mozi_pattern
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
POST /_next HTTP/1.1 Host: 62.3.50.33:9443 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14;
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:9443
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 14;
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:9443 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 990,
"payload_entropy": 5.684030213669503,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "https",
"app_proto": "https",
"asn": 49870,
"country": "SC",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f4665abecd058e1884fa8dd4266c591b080098e9",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0600"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0842",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "db1e30792c6746dfd5cef4d2b249d6fc",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 52
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"evidence": {
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "380e13d21a9cf27bd223ba2635803eb6712ca872",
"protocol_details": {
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"attack_vector": "http smuggling probe \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTPS",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http smuggling probe \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"http_alt_port",
"mozi_pattern",
"net_web_probe",
"websphere_probe"
]
}
16/07/2026 14:27:15 UTC
TCP
9443 · HTTPS
Sonde HTTP
Sonde HTTP · via HTTPS:9443 · (sonde / probe)
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9443
Chemin / cible
—
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 66%
Confiance classification
66%
Risque capteur
Moyen
· 40
Confiance : Confiance 66 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0600
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "https",
"app_proto": "https",
"asn": 49870,
"country": "SC",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0
},
"risk_score": 40,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9e051dab14e664422e109355079a354ee45b9a69",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 66%",
"confidence": 0.66,
"classification_confidence": 0.66,
"precision_score": 74,
"precision_signals": [
"pat-0600",
"INT-single-port"
],
"kb_rule_ids": [
"pat-0600",
"INT-single-port"
],
"matched_patterns": [
"pat-0600"
],
"matched_pattern_names": [
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 40
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 66,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0c7f0116ad39c58f5f8a2af0ad69e91ad61e933f",
"protocol_details": {
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 66 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 66%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 66%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 66,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0600",
"INT-single-port"
],
"tags_summary_labels_fr": [
"pat-0600",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 66 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 66 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe"
]
}
16/07/2026 14:27:15 UTC
TCP
9443 · HTTPS
Sonde HTTP smuggling
http smuggling probe · via HTTPS:9443 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Investiguer
Tags
http_alt_port
mozi_pattern
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
POST / HTTP/1.1 Host: 62.3.50.33:9443 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:9443
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:9443 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, deflate Next-
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 949,
"payload_entropy": 5.65249454871103,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "https",
"app_proto": "https",
"asn": 49870,
"country": "SC",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "f4665abecd058e1884fa8dd4266c591b080098e9",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0600"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0842",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5158cddd85d7d844d45c148bd3d13f4c",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 52
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nNext-",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nNext-",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "60c454ce617a61ddd616294bec28a81bea4eea40",
"protocol_details": {
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "http smuggling probe \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTPS",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 33,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http smuggling probe \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9443\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"http_alt_port",
"mozi_pattern",
"net_web_probe",
"websphere_probe"
]
}
16/07/2026 14:04:51 UTC
TCP
18080 · MONERO P2P
Sonde HTTP smuggling
http smuggling probe · via MONERO P2P:18080 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MONERO-P2P
WAF
—
Recommandation
Investiguer
Tags
monero_p2p_emulated
monero_p2p_payload
mozi_pattern
net_monero_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
18080
Chemin / cible
—
Service
MONERO P2P
Payload
POST /_next/server HTTP/1.1 Host: 62.3.50.33:18080 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; U;
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:18080
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; U;
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:18080 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "01110101010101010000000000000000",
"emulator_response_len": 16,
"bytes_in": 977,
"payload_entropy": 5.657947007962787,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "monero-p2p",
"app_proto": "monero-p2p",
"asn": 49870,
"country": "SC",
"dst_port": 18080,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "3f143756998a97e0bc85f4bd3fb2809e12e8697c",
"event_fingerprint": "9805bd2d8e2babb93b4750898ffa60f92edfba86",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "monero-p2p",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f3104772a97bc6f90b17bd611f180355",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 18080,
"service": "monero-p2p",
"service_name": "monero-p2p",
"risk_score": 52
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; ",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U;",
"evidence": {
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b71d16d83c832547d2fdd61c61b92f030a31b018",
"protocol_details": {
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U;",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U;",
"attack_vector": "http smuggling probe \u00b7 via MONERO P2P:18080 \u00b7 (tentative d'exploit)",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via MONERO P2P",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "monero-p2p",
"service_label_fr": "MONERO P2P",
"dst_port": 18080,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-monero-p2p",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U;",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"attack_vector": "http smuggling probe \u00b7 via MONERO P2P:18080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U;",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "monero_p2p",
"service_banner": "honeypot-monero-p2p",
"service_os": "linux",
"dst_port": "18080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"monero_p2p_emulated",
"monero_p2p_payload",
"mozi_pattern",
"net_monero_probe"
]
}
16/07/2026 14:04:51 UTC
TCP
18080 · MONERO P2P
Sonde HTTP smuggling
http smuggling probe · via MONERO P2P:18080 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MONERO-P2P
WAF
—
Recommandation
Investiguer
Tags
monero_p2p_emulated
monero_p2p_payload
mozi_pattern
net_monero_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
18080
Chemin / cible
—
Service
MONERO P2P
Payload
POST /app HTTP/1.1 Host: 62.3.50.33:18080 Content-Length: 512 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Ma
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:18080
Content-Length: 512
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Intel Ma
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:18080 Content-Length: 512 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Acti
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "01110101010101010000000000000000",
"emulator_response_len": 16,
"bytes_in": 937,
"payload_entropy": 5.656981897578594,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "monero-p2p",
"app_proto": "monero-p2p",
"asn": 49870,
"country": "SC",
"dst_port": 18080,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "3f143756998a97e0bc85f4bd3fb2809e12e8697c",
"event_fingerprint": "9805bd2d8e2babb93b4750898ffa60f92edfba86",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "monero-p2p",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3b672aca8b3753c3ebee532b74a8f279",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 18080,
"service": "monero-p2p",
"service_name": "monero-p2p",
"risk_score": 52
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Acti",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"evidence": {
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Acti",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fd6d7d026aacdd214cd97cdb361b72973440ba1c",
"protocol_details": {
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"attack_vector": "http smuggling probe \u00b7 via MONERO P2P:18080 \u00b7 (tentative d'exploit)",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via MONERO P2P",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "monero-p2p",
"service_label_fr": "MONERO P2P",
"dst_port": 18080,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-monero-p2p",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"attack_vector": "http smuggling probe \u00b7 via MONERO P2P:18080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Ma",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "monero_p2p",
"service_banner": "honeypot-monero-p2p",
"service_os": "linux",
"dst_port": "18080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"monero_p2p_emulated",
"monero_p2p_payload",
"mozi_pattern",
"net_monero_probe"
]
}
16/07/2026 14:04:51 UTC
TCP
18080 · MONERO P2P
Sonde HTTP smuggling
http smuggling probe · via MONERO P2P:18080 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MONERO-P2P
WAF
—
Recommandation
Investiguer
Tags
monero_p2p_emulated
monero_p2p_payload
mozi_pattern
net_monero_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
18080
Chemin / cible
—
Service
MONERO P2P
Payload
POST /api/route HTTP/1.1 Host: 62.3.50.33:18080 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Androi
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:18080
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; Androi
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:18080 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "01110101010101010000000000000000",
"emulator_response_len": 16,
"bytes_in": 956,
"payload_entropy": 5.648663203486858,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "monero-p2p",
"app_proto": "monero-p2p",
"asn": 49870,
"country": "SC",
"dst_port": 18080,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "3f143756998a97e0bc85f4bd3fb2809e12e8697c",
"event_fingerprint": "9805bd2d8e2babb93b4750898ffa60f92edfba86",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "monero-p2p",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "0c207e1ecb28bd0bf90ffccf09e122e3",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 18080,
"service": "monero-p2p",
"service_name": "monero-p2p",
"risk_score": 52
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Androi",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Androi",
"evidence": {
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Androi",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6307a2201467870f763b60b36e1801886c39add3",
"protocol_details": {
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Androi",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Androi",
"attack_vector": "http smuggling probe \u00b7 via MONERO P2P:18080 \u00b7 (tentative d'exploit)",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via MONERO P2P",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "monero-p2p",
"service_label_fr": "MONERO P2P",
"dst_port": 18080,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-monero-p2p",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Androi",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"attack_vector": "http smuggling probe \u00b7 via MONERO P2P:18080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Androi",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "monero_p2p",
"service_banner": "honeypot-monero-p2p",
"service_os": "linux",
"dst_port": "18080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"monero_p2p_emulated",
"monero_p2p_payload",
"mozi_pattern",
"net_monero_probe"
]
}
16/07/2026 14:04:50 UTC
TCP
18080 · MONERO P2P
Sonde HTTP smuggling
http smuggling probe · via MONERO P2P:18080 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MONERO-P2P
WAF
—
Recommandation
Investiguer
Tags
monero_p2p_emulated
monero_p2p_payload
mozi_pattern
net_monero_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
18080
Chemin / cible
—
Service
MONERO P2P
Payload
POST /api HTTP/1.1 Host: 62.3.50.33:18080 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:18080
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:18080 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "01110101010101010000000000000000",
"emulator_response_len": 16,
"bytes_in": 938,
"payload_entropy": 5.626921861791537,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "monero-p2p",
"app_proto": "monero-p2p",
"asn": 49870,
"country": "SC",
"dst_port": 18080,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "3f143756998a97e0bc85f4bd3fb2809e12e8697c",
"event_fingerprint": "9805bd2d8e2babb93b4750898ffa60f92edfba86",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "monero-p2p",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4a2a96e6295e163ab00e8e6abf6303d4",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 18080,
"service": "monero-p2p",
"service_name": "monero-p2p",
"risk_score": 52
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"evidence": {
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "808bbe857239761d0236c1c0aa8e8488c12fb7c5",
"protocol_details": {
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"attack_vector": "http smuggling probe \u00b7 via MONERO P2P:18080 \u00b7 (tentative d'exploit)",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via MONERO P2P",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "monero-p2p",
"service_label_fr": "MONERO P2P",
"dst_port": 18080,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-monero-p2p",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"attack_vector": "http smuggling probe \u00b7 via MONERO P2P:18080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "monero_p2p",
"service_banner": "honeypot-monero-p2p",
"service_os": "linux",
"dst_port": "18080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"monero_p2p_emulated",
"monero_p2p_payload",
"mozi_pattern",
"net_monero_probe"
]
}
16/07/2026 14:04:49 UTC
TCP
18080 · MONERO P2P
Sonde HTTP smuggling
http smuggling probe · via MONERO P2P:18080 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MONERO-P2P
WAF
—
Recommandation
Investiguer
Tags
monero_p2p_emulated
monero_p2p_payload
mozi_pattern
net_monero_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
18080
Chemin / cible
—
Service
MONERO P2P
Payload
POST /_next HTTP/1.1 Host: 62.3.50.33:18080 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:18080
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 10
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:18080 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-Act
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "01110101010101010000000000000000",
"emulator_response_len": 16,
"bytes_in": 945,
"payload_entropy": 5.664407674006169,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "monero-p2p",
"app_proto": "monero-p2p",
"asn": 49870,
"country": "SC",
"dst_port": 18080,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "3f143756998a97e0bc85f4bd3fb2809e12e8697c",
"event_fingerprint": "9805bd2d8e2babb93b4750898ffa60f92edfba86",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "monero-p2p",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b4b881f3f4d531fddc9b04b6bf5ab141",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 18080,
"service": "monero-p2p",
"service_name": "monero-p2p",
"risk_score": 52
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Act",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10",
"evidence": {
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Act",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fa55b658c0e5e7585f5bcceb53ad2dda330564fe",
"protocol_details": {
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10",
"attack_vector": "http smuggling probe \u00b7 via MONERO P2P:18080 \u00b7 (tentative d'exploit)",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via MONERO P2P",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "monero-p2p",
"service_label_fr": "MONERO P2P",
"dst_port": 18080,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-monero-p2p",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"attack_vector": "http smuggling probe \u00b7 via MONERO P2P:18080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "monero_p2p",
"service_banner": "honeypot-monero-p2p",
"service_os": "linux",
"dst_port": "18080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"monero_p2p_emulated",
"monero_p2p_payload",
"mozi_pattern",
"net_monero_probe"
]
}
16/07/2026 14:04:47 UTC
TCP
18080 · MONERO P2P
monero probe
monero probe · via MONERO P2P:18080 · (sonde / probe)
Élevée
Faible · 34
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
MONERO-P2P
WAF
—
Recommandation
Surveiller
Tags
monero_p2p_emulated
net_monero_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
18080
Chemin / cible
—
Pourquoi cette classification : Type « monero_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 34
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "01110101010101010000000000000000",
"emulator_response_len": 16,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "monero-p2p",
"app_proto": "monero-p2p",
"asn": 49870,
"country": "SC",
"dst_port": 18080,
"risk_waf": 8,
"risk_classification": 53,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 53,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 34,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "716189a9480ba649b48e45f3f0bcacb70ef00e72",
"event_fingerprint": "9805bd2d8e2babb93b4750898ffa60f92edfba86",
"classification_reason": "Type \u00ab monero_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 53,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"named_classification_skipped": false,
"service_name": "monero-p2p",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "8f5f48fae11b9586096853e48ad6d2da"
},
"target_context": {
"dst_port": 18080,
"service": "monero-p2p",
"service_name": "monero-p2p",
"risk_score": 34
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "32f97fadc139e5b4a920b34e6dd2113f58fb41d3",
"protocol_details": {
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"attack_vector": "monero probe \u00b7 via MONERO P2P:18080 \u00b7 (sonde \/ probe)",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab monero_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab monero_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 53,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 34
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 34,
"risk_label": "Faible",
"service_name": "monero-p2p",
"service_label_fr": "MONERO P2P",
"dst_port": 18080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-monero-p2p",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"attack_vector": "monero probe \u00b7 via MONERO P2P:18080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "monero_p2p",
"service_banner": "honeypot-monero-p2p",
"service_os": "linux",
"dst_port": "18080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"monero_p2p_emulated",
"net_monero_probe"
]
}
16/07/2026 14:04:47 UTC
TCP
18080 · MONERO P2P
Sonde HTTP smuggling
http smuggling probe · via MONERO P2P:18080 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
MONERO-P2P
WAF
—
Recommandation
Investiguer
Tags
monero_p2p_emulated
monero_p2p_payload
mozi_pattern
net_monero_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
18080
Chemin / cible
—
Service
MONERO P2P
Payload
POST / HTTP/1.1 Host: 62.3.50.33:18080 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:18080
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:18080 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-Encoding: gz
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "01110101010101010000000000000000",
"emulator_response_len": 16,
"bytes_in": 966,
"payload_entropy": 5.661177576739189,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "monero-p2p",
"app_proto": "monero-p2p",
"asn": 49870,
"country": "SC",
"dst_port": 18080,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 2.5,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "3f143756998a97e0bc85f4bd3fb2809e12e8697c",
"event_fingerprint": "9805bd2d8e2babb93b4750898ffa60f92edfba86",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "monero-p2p",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c8ba411eae28a00c82411cab15ca6104",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 18080,
"service": "monero-p2p",
"service_name": "monero-p2p",
"risk_score": 52
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS ",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: gz",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS",
"evidence": {
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: gz",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "64dffdfc87a780c435c6bfc202095c0b17b4ed9f",
"protocol_details": {
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS",
"attack_vector": "http smuggling probe \u00b7 via MONERO P2P:18080 \u00b7 (tentative d'exploit)",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via MONERO P2P",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "monero-p2p",
"service_label_fr": "MONERO P2P",
"dst_port": 18080,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-monero-p2p",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS",
"port": 18080,
"service": "monero-p2p",
"service_label_fr": "MONERO P2P"
},
"attack_vector": "http smuggling probe \u00b7 via MONERO P2P:18080 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:18080\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS",
"target_port_label": "18080 \u00b7 MONERO P2P",
"emulator_service": "monero-p2p",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "monero_p2p",
"service_banner": "honeypot-monero-p2p",
"service_os": "linux",
"dst_port": "18080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"monero_p2p_emulated",
"monero_p2p_payload",
"mozi_pattern",
"net_monero_probe"
]
}
16/07/2026 13:31:19 UTC
TCP
8002 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8002 · (tentative d'exploit) · → /app
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007;…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8002
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:8002
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 14; S
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:8002 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1978af5307537775fab4b66b0f1439319be37ce1",
"http_host_hash": "348a4d91a8c00fab2128459a9b3a8774d81f2daa",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 994,
"payload_entropy": 5.661936355296453,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8002,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "ea69735d342db9f756b592f5e3ce9e43fc28710b",
"event_fingerprint": "e706ee26d735dd5153e2fcec3838b3911c543e74",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7967be4fa492cfad4b86b41e3ae090e9",
"payload_hash": "3742ef65b5e93cb78f279e63a435cbcb",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 8002,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d30bc69cf7e5b1fb401acfc9d545aa19dad957da",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; S",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8002"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 13:31:19 UTC
TCP
8002 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8002 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8002
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:8002
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:8002 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, defla
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858",
"http_host_hash": "348a4d91a8c00fab2128459a9b3a8774d81f2daa",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 958,
"payload_entropy": 5.62485050495973,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8002,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 16,
"anomaly_count": 0,
"campaign_key": "c436cf5e9f7b6c4ab2760ee16b4b7a597eec1318",
"event_fingerprint": "8bc02f524af879f00f3d1fa87ebfdfc13cd5026b",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee",
"payload_hash": "e848bc28f3023f0c0109a7936482a452",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 8002,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7d255189e7c3b37e7e41ea70dcab96f4641787c2",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8002"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 13:31:18 UTC
TCP
8002 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8002 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8002
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:8002
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Windows NT
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:8002 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, de
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858",
"http_host_hash": "348a4d91a8c00fab2128459a9b3a8774d81f2daa",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 961,
"payload_entropy": 5.661232598958626,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8002,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "8b2ef372f912c3c4447a505985887c44239926ac",
"event_fingerprint": "3923a240dce13c5c2be59edd666d9e6e5cf802b5",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee",
"payload_hash": "1cb3fb4da02718d2fbb35ce73a82af2d",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 8002,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT ",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, de",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, de",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "24af999feea2c2d7b28f24dc9d7eb6cba8eea74f",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8002"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 13:31:17 UTC
TCP
8002 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8002 · (tentative d'exploit) · → /api
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8002
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:8002
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:8002 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Actio
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a",
"http_host_hash": "348a4d91a8c00fab2128459a9b3a8774d81f2daa",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 943,
"payload_entropy": 5.652533623411877,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8002,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "62701014774cdf459e7a63d929cbd2d81155a567",
"event_fingerprint": "c47b56c3f340352345c21f4072c1a01e403dd325",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de",
"payload_hash": "1fee702d46d81de32ac9e91a1152cd1b",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 8002,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a7b8455b8e52a98a1fc2af6e5fcb6d8f2221a7b8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8002"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 13:31:16 UTC
TCP
8002 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8002 · (tentative d'exploit) · → /_next
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8002
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:8002
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; W
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:8002 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, deflate
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858",
"http_host_hash": "348a4d91a8c00fab2128459a9b3a8774d81f2daa",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 960,
"payload_entropy": 5.643257639977388,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8002,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "ea69735d342db9f756b592f5e3ce9e43fc28710b",
"event_fingerprint": "e6f61bf7ede69d721a984c0b7812a2281fcff1ad",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee",
"payload_hash": "b21ce86e4a8a5d91732dad2ca46a75b6",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 8002,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\n",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\n",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3c87145b6dc663a5bae6c87741b9c8f26373b4e5",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8002"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 13:31:15 UTC
TCP
8002 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8002 · (tentative d'exploit)
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8002
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:8002
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:8002 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Ne
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "348a4d91a8c00fab2128459a9b3a8774d81f2daa",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 934,
"payload_entropy": 5.684476617055688,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8002,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "d926abe2562db406c15003c5e148a6647e7f9e69",
"event_fingerprint": "510fcdae07d5d5059148ee8e4d1a12bc769788bf",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "c0ce1ce4bc4db3ab914e3dbeb6ea41b4",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8002,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Ne",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Ne",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fa2017c1368161a11c7cca22805b07ace62b8a70",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit)",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8002"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
16/07/2026 13:31:14 UTC
TCP
8002 · HTTP ALT 8002
http-alt-8002
http-alt-8002 · via HTTP ALT 8002:8002 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTP-ALT-8002
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8002
Chemin / cible
—
Pourquoi cette classification : Type « http-alt-8002 » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http-alt-8002",
"app_proto": "http-alt-8002",
"asn": 49870,
"country": "SC",
"dst_port": 8002,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "582e5a3152b1101b4b5d4549cbc36b793263a997",
"event_fingerprint": "b153b3db989573d0da5826027e7e48a3dc2f03c9",
"classification_reason": "Type \u00ab http-alt-8002 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0.08,
"classification_confidence": 0.08,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http-alt-8002",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "3f0ab0b98b6c7ff79284dfc145c73561"
},
"target_context": {
"dst_port": 8002,
"service": "http-alt-8002",
"service_name": "http-alt-8002",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8deaa4db25e63eb57536f35565d38c6719e62470",
"protocol_details": {
"port": 8002,
"service": "http-alt-8002",
"service_label_fr": "HTTP ALT 8002"
},
"attack_vector": "http-alt-8002 \u00b7 via HTTP ALT 8002:8002 \u00b7 (sonde \/ probe)",
"target_port_label": "8002 \u00b7 HTTP ALT 8002",
"emulator_service": "http-alt-8002",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http-alt-8002 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab http-alt-8002 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 8,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "http-alt-8002",
"service_label_fr": "HTTP ALT 8002",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8002",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 8002,
"service": "http-alt-8002",
"service_label_fr": "HTTP ALT 8002"
},
"attack_vector": "http-alt-8002 \u00b7 via HTTP ALT 8002:8002 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8002 \u00b7 HTTP ALT 8002",
"emulator_service": "http-alt-8002",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8002",
"service_banner": "honeypot-http-alt-8002",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8002"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
16/07/2026 13:31:12 UTC
TCP
8002 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8002 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8002
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:8002
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:8002 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: poop1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "fac64969f9eca34262c56352be2d62dd2d22b1a0",
"http_host_hash": "348a4d91a8c00fab2128459a9b3a8774d81f2daa",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 905,
"payload_entropy": 5.595444857867811,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8002,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 16,
"anomaly_count": 0,
"campaign_key": "c436cf5e9f7b6c4ab2760ee16b4b7a597eec1318",
"event_fingerprint": "8bc02f524af879f00f3d1fa87ebfdfc13cd5026b",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9f10b48170735feac18b44fa385fef37",
"payload_hash": "f056b767844528b6cbd01fd13e9f9dff",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 8002,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "13cd96cfb44faed69abe407d73781e4b4e5fc667",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8002"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 13:31:11 UTC
TCP
8002 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8002 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8002
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:8002
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Macintosh;
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:8002 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate N
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a",
"http_host_hash": "348a4d91a8c00fab2128459a9b3a8774d81f2daa",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 952,
"payload_entropy": 5.622061815242143,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8002,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "8b2ef372f912c3c4447a505985887c44239926ac",
"event_fingerprint": "3923a240dce13c5c2be59edd666d9e6e5cf802b5",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de",
"payload_hash": "7a6c2650550620f413b7e4dc9941a009",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 8002,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; ",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c503a22c73edcbf0535823d34dca3a4347a744cd",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8002"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 13:31:11 UTC
TCP
8002 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8002 · (tentative d'exploit) · → /app
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8002
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:8002
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86_64) A
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:8002 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-R
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd",
"http_host_hash": "348a4d91a8c00fab2128459a9b3a8774d81f2daa",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 927,
"payload_entropy": 5.668110860604804,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8002,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "ea69735d342db9f756b592f5e3ce9e43fc28710b",
"event_fingerprint": "e706ee26d735dd5153e2fcec3838b3911c543e74",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "72d43eb808798db218d063798749cc39",
"payload_hash": "901b25af0a0b09945cf3219f46703b57",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 8002,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-R",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-R",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f837f451697647b00ab31095342d01762b1672fa",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8002"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 13:31:09 UTC
TCP
8002 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8002 · (tentative d'exploit) · → /api
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8002
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:8002
Content-Length: 512
Connection: close
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone O
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:8002 Content-Length: 512 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-Encoding:
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe",
"http_host_hash": "348a4d91a8c00fab2128459a9b3a8774d81f2daa",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 961,
"payload_entropy": 5.669555071167129,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8002,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "62701014774cdf459e7a63d929cbd2d81155a567",
"event_fingerprint": "c47b56c3f340352345c21f4072c1a01e403dd325",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b",
"payload_hash": "60e381bbf3cc227c059c07581abb8ebd",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 8002,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: ",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: ",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b8a4b38dc0f599f78c9ea7bc7c172142ea1c2da3",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8002"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 13:31:08 UTC
TCP
8002 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8002 · (tentative d'exploit) · → /_next
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8002
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:8002
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; Android
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:8002 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gzip,
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea",
"http_host_hash": "348a4d91a8c00fab2128459a9b3a8774d81f2daa",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 969,
"payload_entropy": 5.64255676035069,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8002,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "ea69735d342db9f756b592f5e3ce9e43fc28710b",
"event_fingerprint": "e6f61bf7ede69d721a984c0b7812a2281fcff1ad",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6c8160595869adea51d6742918f57fdf",
"payload_hash": "73d59611b02c55c0e2daf7df4807db06",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 8002,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android ",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, ",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, ",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c1c8a318db2686d6edd02f0018f767461d7f9558",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8002"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 13:31:07 UTC
TCP
8002 · HTTP ALT 8002
http-alt-8002
http-alt-8002 · via HTTP ALT 8002:8002 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTP-ALT-8002
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8002
Chemin / cible
—
Pourquoi cette classification : Type « http-alt-8002 » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http-alt-8002",
"app_proto": "http-alt-8002",
"asn": 49870,
"country": "SC",
"dst_port": 8002,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.6,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "582e5a3152b1101b4b5d4549cbc36b793263a997",
"event_fingerprint": "b153b3db989573d0da5826027e7e48a3dc2f03c9",
"classification_reason": "Type \u00ab http-alt-8002 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "http-alt-8002",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "3f0ab0b98b6c7ff79284dfc145c73561"
},
"target_context": {
"dst_port": 8002,
"service": "http-alt-8002",
"service_name": "http-alt-8002",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8deaa4db25e63eb57536f35565d38c6719e62470",
"protocol_details": {
"port": 8002,
"service": "http-alt-8002",
"service_label_fr": "HTTP ALT 8002"
},
"attack_vector": "http-alt-8002 \u00b7 via HTTP ALT 8002:8002 \u00b7 (sonde \/ probe)",
"target_port_label": "8002 \u00b7 HTTP ALT 8002",
"emulator_service": "http-alt-8002",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http-alt-8002 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab http-alt-8002 \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "http-alt-8002",
"service_label_fr": "HTTP ALT 8002",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http-alt-8002",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 8002,
"service": "http-alt-8002",
"service_label_fr": "HTTP ALT 8002"
},
"attack_vector": "http-alt-8002 \u00b7 via HTTP ALT 8002:8002 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8002 \u00b7 HTTP ALT 8002",
"emulator_service": "http-alt-8002",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http_alt_8002",
"service_banner": "honeypot-http-alt-8002",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
16/07/2026 13:31:07 UTC
TCP
8002 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8002 · (tentative d'exploit)
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8002
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:8002
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 1
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:8002 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-Encoding: gzi
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe",
"http_host_hash": "348a4d91a8c00fab2128459a9b3a8774d81f2daa",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 965,
"payload_entropy": 5.682231702012917,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8002,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 72,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "d926abe2562db406c15003c5e148a6647e7f9e69",
"event_fingerprint": "510fcdae07d5d5059148ee8e4d1a12bc769788bf",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b",
"payload_hash": "2c9ea161a5ab0d3b1e88aa6588e242e7",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8002,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 1",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: gzi",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 1",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: gzi",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 1",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3d5b67f3e7ad66f3c0cf71422e18dc8fd47198e8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 1",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit)",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8002,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 8002,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8002 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8002\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 1",
"target_port_label": "8002 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8002"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"http-alt-8002"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
16/07/2026 13:18:56 UTC
TCP
3030 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3030 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3030
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:3030
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Windows NT
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:3030 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: po
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "fac64969f9eca34262c56352be2d62dd2d22b1a0",
"http_host_hash": "84c2c0dcf1358c41c4494b8d54c203d2fb6899e2",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 921,
"payload_entropy": 5.581344836641455,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3030,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "cbfbf13d9a03809513a6aea3adbd473f8e52c07f",
"event_fingerprint": "a8c74a382dfbb6e81b04cb10b460ea132e1fd79e",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9f10b48170735feac18b44fa385fef37",
"payload_hash": "09b031028c3c827d01dff7e4b51e2405",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 3030,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT ",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: po",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: po",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c511dc895a4803d1b8f62056f3c9e7959807bee4",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 3030,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3030 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "3030 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3030,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 3030,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3030 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"target_port_label": "3030 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3030"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3030"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 13:18:56 UTC
TCP
3030 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3030 · (tentative d'exploit) · → /app
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3030
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:3030
Content-Length: 512
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:3030 Content-Length: 512 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Actio
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a",
"http_host_hash": "84c2c0dcf1358c41c4494b8d54c203d2fb6899e2",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 936,
"payload_entropy": 5.643602472185628,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3030,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "665776c57ce1bddd0caba1c69a75c6f2a794c115",
"event_fingerprint": "f71a7de6c0b20921018d9172864d14c8aad6ebcd",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de",
"payload_hash": "5fc1cd2ec19dbd4d003ea571c9d36b10",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 3030,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aa6422f83a9aa702a734be8fffc81b2e8b6b7f32",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3030,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3030 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "3030 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3030,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3030,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3030 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "3030 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3030"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3030"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 13:18:56 UTC
TCP
3030 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3030 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3030
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:3030
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; Andr
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:3030 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gz
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea",
"http_host_hash": "84c2c0dcf1358c41c4494b8d54c203d2fb6899e2",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 966,
"payload_entropy": 5.666215126107678,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3030,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "82bb0e1fd44fed107a972f6527f5e2172ef7a5d5",
"event_fingerprint": "f47465e0d9d5904ec0e39f3cf2eb6bed0d9558d2",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6c8160595869adea51d6742918f57fdf",
"payload_hash": "127a49f92bf0097cc8f8e791fc9553f5",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 3030,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gz",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gz",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "07a4be81fa5445b66e41f8df79173caee9bc9faa",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 3030,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3030 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "3030 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3030,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 3030,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3030 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
"target_port_label": "3030 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3030"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3030"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 13:18:54 UTC
TCP
3030 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3030 · (tentative d'exploit) · → /api
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3030
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:3030
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 145
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:3030 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "84c2c0dcf1358c41c4494b8d54c203d2fb6899e2",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 937,
"payload_entropy": 5.667534438948893,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3030,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "6e7d1dd5a290c95c796e7a6df5a7c60656ea32b6",
"event_fingerprint": "8d9e35cc216908c13793f47331cc4aa3eab353cb",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "fac1cde7546b211b1d09c84c8b45fa35",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 3030,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ebf44428f78d7766e36ac0ba3653c20e6442b54",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3030,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3030 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "3030 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3030,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3030,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3030 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"target_port_label": "3030 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3030"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3030"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
16/07/2026 13:18:53 UTC
TCP
3030 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3030 · (tentative d'exploit) · → /_next
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3030
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:3030
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 1
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:3030 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "84c2c0dcf1358c41c4494b8d54c203d2fb6899e2",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 939,
"payload_entropy": 5.644332401799627,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3030,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "665776c57ce1bddd0caba1c69a75c6f2a794c115",
"event_fingerprint": "889e5390e3f874c74a0ee923cd03e1cfa5ecf5cc",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "b7e86390e5c42cddc23667866ae7d24f",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 3030,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "84ea7de8877e9e8ec098178273cb74fe325f6cc0",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3030,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3030 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "3030 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3030,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3030,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3030 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3030\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1",
"target_port_label": "3030 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3030"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:3030"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}