21/07/2026 20:56:34 UTC
TCP
2466 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:2466 · (tentative d'exploit) · → /app
Élevée
Élevé · 74
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2466
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 74
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:2466
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 145
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:2466 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "ddebf533d249deb88b6cb386d824f2e0ec7a6f28",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 936,
"payload_entropy": 5.6142273538967284,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 2466,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 74,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "8aaeac83bcdbbe0098d703dc9f9433aab6c0bf90",
"event_fingerprint": "57e538eead5f6d57abe5dac5754ab90135055007",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "2915409e0a287fd4950a2ec70cd05570",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 2466,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c83fa9b91b701733112a08a2a12250019ca7a527",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 2466,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"attack_vector": "http smuggling probe \u00b7 via HTTP:2466 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "2466 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2466,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 2466,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:2466 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"target_port_label": "2466 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2466"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:2466"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 20:56:34 UTC
TCP
2466 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:2466 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 74
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2466
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 74
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:2466
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; Andr
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:2466 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gz
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea",
"http_host_hash": "ddebf533d249deb88b6cb386d824f2e0ec7a6f28",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 967,
"payload_entropy": 5.65708772177705,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 2466,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 74,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "d1757936b7dc3422ab30e3e6044ba4e30c6ecdd6",
"event_fingerprint": "bfe5ddc9ba147f94be581c201ac00ba57b0f38fe",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6c8160595869adea51d6742918f57fdf",
"payload_hash": "92dc96089cead031f554c717ffbc3490",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 2466,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gz",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gz",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bfc19896876356fb7c581429ab9d520b9480031a",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 2466,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
"attack_vector": "http smuggling probe \u00b7 via HTTP:2466 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "2466 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2466,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 2466,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:2466 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
"target_port_label": "2466 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2466"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:2466"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 20:56:32 UTC
TCP
2466 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:2466 · (tentative d'exploit) · → /api
Élevée
Élevé · 74
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2466
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 74
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:2466
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:2466 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Actio
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a",
"http_host_hash": "ddebf533d249deb88b6cb386d824f2e0ec7a6f28",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 950,
"payload_entropy": 5.6219641413952495,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 2466,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 74,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "5415b66bb564dfa455c1fcbf10a34572bfd8f057",
"event_fingerprint": "28e9e78195adab731fb816ca78e75c5e2f358546",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de",
"payload_hash": "e45956cd6fffe22a65df7cd9a0de75b2",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 2466,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "56ebba51859e14d4a7f550aacb990a72e4546abc",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 2466,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "http smuggling probe \u00b7 via HTTP:2466 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "2466 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2466,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 2466,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:2466 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "2466 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2466"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:2466"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 20:56:31 UTC
TCP
2466 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:2466 · (tentative d'exploit) · → /_next
Élevée
Élevé · 74
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2466
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 74
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:2466
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:2466 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-Encoding
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe",
"http_host_hash": "ddebf533d249deb88b6cb386d824f2e0ec7a6f28",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 971,
"payload_entropy": 5.65232333113831,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 2466,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 74,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "8aaeac83bcdbbe0098d703dc9f9433aab6c0bf90",
"event_fingerprint": "96864bb4459db4e84557a0698ccd62b71b4e43ea",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b",
"payload_hash": "8920aa9266db70123385eb46643ed634",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 2466,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "92b06b94fbe27b0ff13332894cb615192a63bdf1",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 2466,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"attack_vector": "http smuggling probe \u00b7 via HTTP:2466 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "2466 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2466,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 2466,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:2466 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone",
"target_port_label": "2466 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2466"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:2466"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 20:56:30 UTC
TCP
2466 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:2466 · (tentative d'exploit)
Élevée
Élevé · 74
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2466
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 74
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:2466
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 1
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:2466 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-Encoding: gzi
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe",
"http_host_hash": "ddebf533d249deb88b6cb386d824f2e0ec7a6f28",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 966,
"payload_entropy": 5.67692683113994,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 2466,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 74,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "2e6e2454743f1fc64a7cc5c3a8094ac1716f7a4e",
"event_fingerprint": "8446ad86a51f17d7ec39e474b692fee5eedd35ef",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b",
"payload_hash": "9ae0e310107222f941824520e2f2efc3",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2466,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 1",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: gzi",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 1",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: gzi",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 1",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0f3ba90a8ac9fb8ca07c7d7e9542946e89bdf770",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 2466,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 1",
"attack_vector": "http smuggling probe \u00b7 via HTTP:2466 \u00b7 (tentative d'exploit)",
"target_port_label": "2466 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2466,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 2466,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:2466 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2466\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 1",
"target_port_label": "2466 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2466"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:2466"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 20:56:29 UTC
TCP
2466
—
Sonde port
Sonde port · port 2466 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
2466
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 2466,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "042703f2cc00e98bfe54dbe5e1446772d2308bdc",
"event_fingerprint": "3ccacbad7dc8669f7e1abe64f52b859d2f68daab",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 2466,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ada436b05f29504ad23179dfdb6c68809a895e84",
"protocol_details": {
"port": 2466
},
"attack_vector": "Sonde port \u00b7 port 2466 \u00b7 (sonde \/ probe)",
"target_port_label": "2466",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 2466,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 2466
},
"attack_vector": "Sonde port \u00b7 port 2466 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "2466",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "2466"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
21/07/2026 20:25:23 UTC
TCP
6688 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:6688 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) Appl…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
6688
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:6688
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Linux; Andr
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:6688 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
"http_host_hash": "df3f0e6b0d8ca9cc92aa9215f9902e6dcbea7f6c",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 986,
"payload_entropy": 5.687859750887949,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 6688,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "80ce1b47305102fa1b5b446d2dfc0a8db336a32d",
"event_fingerprint": "fe18a601015867be11741a725fc2a233823a423b",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c772734c6eb2978096c283068906aec3",
"payload_hash": "56f856594c14b7fcfa239114f46b4ca3",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 6688,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d7c3b5428ba099470baf6b620ca2e650996e84a6",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 6688,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"attack_vector": "http smuggling probe \u00b7 via HTTP:6688 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "6688 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6688,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 6688,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:6688 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"target_port_label": "6688 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6688"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:6688"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 20:25:23 UTC
TCP
6688 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:6688 · (tentative d'exploit) · → /app
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
6688
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:6688
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 145
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:6688 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "df3f0e6b0d8ca9cc92aa9215f9902e6dcbea7f6c",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 943,
"payload_entropy": 5.649181189644891,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 6688,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "b73e1e6e1c62ae643e15b35bd142bca3c8333d81",
"event_fingerprint": "63beccc89d2cedbbf371cc8476140d4f566f6633",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "ab512004d15f5cbb5284d80f7c55a3aa",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 6688,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "82a4d79c70f75a956d8d97d766b22e84c64e83e6",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 6688,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"attack_vector": "http smuggling probe \u00b7 via HTTP:6688 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "6688 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6688,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 6688,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:6688 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"target_port_label": "6688 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6688"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:6688"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 20:25:23 UTC
TCP
6688 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:6688 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) Appl…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
6688
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:6688
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:6688 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36 Ac
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
"http_host_hash": "df3f0e6b0d8ca9cc92aa9215f9902e6dcbea7f6c",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 983,
"payload_entropy": 5.654165513183072,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 6688,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "3ee38dfd96c95d8d8284ebd9403975e352b0c393",
"event_fingerprint": "64e1cf1e4a42bad78b637628b1be59f7d6c8bed3",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c772734c6eb2978096c283068906aec3",
"payload_hash": "c0f1d65cc8038b8c4831c289eb7b24f2",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 6688,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAc",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAc",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "58f8638b77af47c5d0e892820bab3cb44ebf0b6a",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 6688,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"attack_vector": "http smuggling probe \u00b7 via HTTP:6688 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "6688 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6688,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 6688,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:6688 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"target_port_label": "6688 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6688"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:6688"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 20:25:22 UTC
TCP
6688 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:6688 · (tentative d'exploit) · → /api
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
6688
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:6688
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 10; K
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:6688 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-Action
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e",
"http_host_hash": "df3f0e6b0d8ca9cc92aa9215f9902e6dcbea7f6c",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 936,
"payload_entropy": 5.65806641886658,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 6688,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "c87ddf80ed70dc3449f374e0c96e86227ac07209",
"event_fingerprint": "74c2f9f4acf044ca0cc7f18d3c0bf72c9fa61caf",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966",
"payload_hash": "ee7c082d9a0a5d5b4f897be8228b6a0d",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 6688,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6b93c09fd422328d7b1822e373beb3c0ae9e14f2",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 6688,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"attack_vector": "http smuggling probe \u00b7 via HTTP:6688 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "6688 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6688,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 6688,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:6688 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"target_port_label": "6688 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6688"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:6688"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 20:25:21 UTC
TCP
6688 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:6688 · (tentative d'exploit) · → /_next
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
6688
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:6688
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; W
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:6688 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533",
"http_host_hash": "df3f0e6b0d8ca9cc92aa9215f9902e6dcbea7f6c",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 939,
"payload_entropy": 5.645085889455024,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 6688,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "b73e1e6e1c62ae643e15b35bd142bca3c8333d81",
"event_fingerprint": "cc8fcce54d2b3d118d9345097a252ec1b34cc509",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3",
"payload_hash": "4041c31b885d9377930fbb6e28ac3725",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 6688,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "734f4f42896a655878ed4a48d4cdafdf8419a210",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 6688,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"attack_vector": "http smuggling probe \u00b7 via HTTP:6688 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "6688 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6688,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 6688,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:6688 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"target_port_label": "6688 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6688"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:6688"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 20:25:19 UTC
TCP
6688
—
Sonde port
Sonde port · port 6688 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
6688
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 6688,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 3.7,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "e564e9d2d85e6ab07678ac506839ff4025183016",
"event_fingerprint": "5cc75bc4da36f0a044b023b65285a13cf5e24a4f",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 6688,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b07d59cf7e6989a110023a3ea10fe2cd9b59092c",
"protocol_details": {
"port": 6688
},
"attack_vector": "Sonde port \u00b7 port 6688 \u00b7 (sonde \/ probe)",
"target_port_label": "6688",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 6688,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 6688
},
"attack_vector": "Sonde port \u00b7 port 6688 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "6688",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "6688"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
21/07/2026 20:25:19 UTC
TCP
6688 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:6688 · (tentative d'exploit)
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
6688
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:6688
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:6688 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-N
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533",
"http_host_hash": "df3f0e6b0d8ca9cc92aa9215f9902e6dcbea7f6c",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 941,
"payload_entropy": 5.654986800208767,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 6688,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "2d74573553c1497dce91e288be9b64de35f5c9cd",
"event_fingerprint": "bd88698a039c3f70b6b11586b1a246fe8cea3293",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3",
"payload_hash": "89ddeff40616c995797122dc19ace0bf",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 6688,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-N",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-N",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6a8245646a0b291b39b484387d143b704e7672fd",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 6688,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "http smuggling probe \u00b7 via HTTP:6688 \u00b7 (tentative d'exploit)",
"target_port_label": "6688 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 6688,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 6688,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:6688 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:6688\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "6688 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "6688"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:6688"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 20:12:28 UTC
TCP
3639 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3639 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3639
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:3639
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:3639 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Act
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "3e8325d8f7705d5d5acf13e1838a48acd794983e",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 952,
"payload_entropy": 5.658567238082546,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3639,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "dae323a295fbe69cc55960d542d26bf9839d2886",
"event_fingerprint": "cf2fbf3b52924f0fe612a7b439ca598b3836cd46",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "ca83d1fe693246725d54052c6969ff16",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 3639,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Act",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Act",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "398f292085165ff42d1456fa7e2103c826167c52",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3639,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3639 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "3639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3639,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3639,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3639 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"target_port_label": "3639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3639"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"sap-ms"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 20:12:28 UTC
TCP
3639 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3639 · (tentative d'exploit) · → /app
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3639
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:3639
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86_64) A
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:3639 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-R
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd",
"http_host_hash": "3e8325d8f7705d5d5acf13e1838a48acd794983e",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 928,
"payload_entropy": 5.640055718450299,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3639,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "71c75808ff3f132143b99434e4cbbd5cc2ff7ead",
"event_fingerprint": "970b51110e9d2ecb694510ff16b8df12a0fd1a0b",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "72d43eb808798db218d063798749cc39",
"payload_hash": "6d0060230062a2c4e4cabf732bd89164",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 3639,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-R",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-R",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ab5c45a3901ea60fe5e1fe67f6f45836309f8deb",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3639,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3639 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "3639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3639,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3639,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3639 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"target_port_label": "3639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3639"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"sap-ms"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 20:12:28 UTC
TCP
3639 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3639 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3639
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:3639
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:3639 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, defla
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858",
"http_host_hash": "3e8325d8f7705d5d5acf13e1838a48acd794983e",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 964,
"payload_entropy": 5.630912386744295,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3639,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "14011f09673efded7049f66f2df6630cb104c909",
"event_fingerprint": "778ce7a3010db8a038185599e87131e492500c68",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee",
"payload_hash": "93053c112fc3b7ba94b7cf43bcbfe3b1",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 3639,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "88247fe6777ec2c2161e25a86d6ab25cc2269c6d",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 3639,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3639 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "3639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3639,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 3639,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3639 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"target_port_label": "3639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3639"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"sap-ms"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 20:12:26 UTC
TCP
3639 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3639 · (tentative d'exploit) · → /api
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3639
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:3639
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 145
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:3639 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "3e8325d8f7705d5d5acf13e1838a48acd794983e",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 936,
"payload_entropy": 5.654186440248927,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3639,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "d383058288f4a019dde92bfdc5094d9cc32519bb",
"event_fingerprint": "7e63196be813110544f11a7ea28fabed297ff62c",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "ebf6d12ba94e13a0047b18a8626077e0",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 3639,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "586d0572ccf18ef25d5e0cc376749ac9cb6b34da",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3639,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3639 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "3639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3639,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 3639,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3639 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"target_port_label": "3639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3639"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"sap-ms"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 20:12:25 UTC
TCP
3639 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3639 · (tentative d'exploit) · → /_next
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3639
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:3639
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 10;
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:3639 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-Acti
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e",
"http_host_hash": "3e8325d8f7705d5d5acf13e1838a48acd794983e",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 951,
"payload_entropy": 5.625239052974308,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3639,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "71c75808ff3f132143b99434e4cbbd5cc2ff7ead",
"event_fingerprint": "cdb77a450c96b3d744aa6bcec9208539a78c804a",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966",
"payload_hash": "f9118b1640751a5929bc0e4b93e14f47",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 3639,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Acti",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Acti",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "31eabdaa992e327ba41c44cc09f2a70d716ed486",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 3639,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3639 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "3639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3639,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 3639,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3639 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;",
"target_port_label": "3639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3639"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"sap-ms"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 20:12:24 UTC
TCP
3639 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:3639 · (tentative d'exploit)
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) Appl…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
3639
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:3639
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWM
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:3639 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36 Accept-Enco
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
"http_host_hash": "3e8325d8f7705d5d5acf13e1838a48acd794983e",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 974,
"payload_entropy": 5.68280813807123,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 3639,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "880f00ab993a24b6b6e2647c6f1a015dc0264065",
"event_fingerprint": "49b290219f504d52072ef48fe44dfae1a6606963",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c772734c6eb2978096c283068906aec3",
"payload_hash": "e9140124d8dd03ea5827edd903a069da",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 3639,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-Enco",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-Enco",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c97470442711b974f2af9df3293672760d5429db",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 3639,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"attack_vector": "http smuggling probe \u00b7 via HTTP:3639 \u00b7 (tentative d'exploit)",
"target_port_label": "3639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 3639,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 3639,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:3639 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3639\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"target_port_label": "3639 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "3639"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"sap-ms"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 20:12:23 UTC
TCP
3639 · SAP Message Server
sap-ms
sap-ms · via SAP Message Server:3639 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
SAP-MS
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
3639
Chemin / cible
—
Service
SAP Message Server
Pourquoi cette classification : Type « sap-ms » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "sap-ms",
"app_proto": "sap-ms",
"asn": 49870,
"country": "SC",
"dst_port": 3639,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "d1ac804205f0db7497ad6a38377eb90f0e701562",
"event_fingerprint": "4d5b3c3cfcb26426084575f2bd5e9083af18818c",
"classification_reason": "Type \u00ab sap-ms \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "sap-ms",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "2a70f552dbbe1ed2e63bb502e8538fa6"
},
"target_context": {
"dst_port": 3639,
"service": "sap-ms",
"service_name": "sap-ms",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "209291eab75333e9c2a834ef59002287423b1408",
"protocol_details": {
"port": 3639,
"service": "sap-ms",
"service_label_fr": "SAP Message Server"
},
"attack_vector": "sap-ms \u00b7 via SAP Message Server:3639 \u00b7 (sonde \/ probe)",
"target_port_label": "3639 \u00b7 SAP Message Server",
"emulator_service": "sap-ms",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab sap-ms \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab sap-ms \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "sap-ms",
"service_label_fr": "SAP Message Server",
"dst_port": 3639,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-sap-ms",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 3639,
"service": "sap-ms",
"service_label_fr": "SAP Message Server"
},
"attack_vector": "sap-ms \u00b7 via SAP Message Server:3639 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "3639 \u00b7 SAP Message Server",
"emulator_service": "sap-ms",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "sap_ms",
"service_banner": "honeypot-sap-ms",
"service_os": "linux",
"dst_port": "3639"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
21/07/2026 19:51:33 UTC
TCP
5100 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5100 · (tentative d'exploit) · → /app
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5100
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:5100
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:5100 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, deflate Ne
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858",
"http_host_hash": "f11135764c7d147dfee27febb7ed471bbb11b6a5",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 952,
"payload_entropy": 5.670421126063972,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5100,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "48f22747644403d9935163bd2e46d4887fc1f710",
"event_fingerprint": "e604a9895f869265c9f82d4958f53de6e7452dc4",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee",
"payload_hash": "ad955d9e46bd63fcf70328aeee0203b2",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 5100,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nNe",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\nNe",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "deeb347dfb81bd060cfe496c721584342f6dce7e",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 5100,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5100 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "5100 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5100,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 5100,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5100 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "5100 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5100"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5100"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 19:51:33 UTC
TCP
5100 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5100 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5100
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:5100
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:5100 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Ne
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd",
"http_host_hash": "f11135764c7d147dfee27febb7ed471bbb11b6a5",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 934,
"payload_entropy": 5.652670056875989,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5100,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "a6eed845efac6940ce9129c8244c8f37ce194b0d",
"event_fingerprint": "b8fad2179f555eb8b2a490e5eeb8d0ac45810967",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "72d43eb808798db218d063798749cc39",
"payload_hash": "74a1eb3f0ccde023ab00e1c93d6692e8",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 5100,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Ne",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Ne",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e7b31e1434ac59e3a50e516446bc0f25ec180a92",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5100,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5100 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "5100 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5100,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5100,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5100 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"target_port_label": "5100 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5100"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5100"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 19:51:32 UTC
TCP
5100 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5100 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5100
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:5100
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:5100 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Act
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "f11135764c7d147dfee27febb7ed471bbb11b6a5",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 952,
"payload_entropy": 5.659315465336827,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5100,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "1af673e57e970ee30df4b02105c195e16c5116ae",
"event_fingerprint": "f1cc994616f352030f9ebd07c4bc7bcf48c61f70",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "b850a2a83cc9a6a6db5e60c3acb6e6bd",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 5100,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Act",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Act",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5d5ef873f81e32009a89d3d6dbe7114ca6c6ed63",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5100,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5100 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "5100 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5100,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5100,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5100 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"target_port_label": "5100 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5100"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5100"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 19:51:31 UTC
TCP
5100 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5100 · (tentative d'exploit) · → /api
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5100
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:5100
Content-Length: 508
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 10; K
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:5100 Content-Length: 508 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-Action
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e",
"http_host_hash": "f11135764c7d147dfee27febb7ed471bbb11b6a5",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 929,
"payload_entropy": 5.64669754240185,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5100,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "52b1967a0eeb38cb084d253a0813bd48620a13e6",
"event_fingerprint": "fd5f5fb6c1945da937f364f16618e861e5886ca0",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966",
"payload_hash": "4afb1b8020891e78f61f1fb3d7f2efb4",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 5100,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "673745ea97eb40d906e7220a4af2ed2840212a08",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 5100,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5100 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "5100 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5100,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 5100,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5100 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"target_port_label": "5100 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5100"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5100"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 19:51:30 UTC
TCP
5100 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5100 · (tentative d'exploit) · → /_next
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5100
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:5100
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; W
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:5100 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533",
"http_host_hash": "f11135764c7d147dfee27febb7ed471bbb11b6a5",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 933,
"payload_entropy": 5.627419809993251,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5100,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "48f22747644403d9935163bd2e46d4887fc1f710",
"event_fingerprint": "23c3774dd6448bc3023a36a21a9e63342935a102",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3",
"payload_hash": "392d409a1f6051b0cc58f4d6c0dec714",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 5100,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "03cdae706aa72e62ca834a2b5dcb3457fb8a6115",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5100,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5100 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "5100 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5100,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5100,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5100 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"target_port_label": "5100 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5100"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5100"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 19:51:29 UTC
TCP
5100 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5100 · (tentative d'exploit)
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5100
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:5100
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 10; K) A
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:5100 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e",
"http_host_hash": "f11135764c7d147dfee27febb7ed471bbb11b6a5",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 946,
"payload_entropy": 5.658057287173967,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5100,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "147753b7b9be5fbc5e395721528647a26ab2b4f9",
"event_fingerprint": "0540b51adb676e8bc11d8233b9b3c118ecfc257d",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966",
"payload_hash": "aa9863f7c868317aae7eb8413e88626b",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 5100,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eb4c36a7ecca54f740cd7d0bb6c13917b5ab9be5",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 5100,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5100 \u00b7 (tentative d'exploit)",
"target_port_label": "5100 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5100,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 5100,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5100 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5100\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"target_port_label": "5100 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5100"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5100"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 19:51:28 UTC
TCP
5100
—
Sonde port
Sonde port · port 5100 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5100
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 5100,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.6,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "6c2bcdf9cc995ece00be4793ee66aff27e1f6a78",
"event_fingerprint": "e66fe40d724c2793dce631d02dab2efc3cddeba9",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5100,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "934c444707043a41f94d1ce5d9d3e191bc0b7cd9",
"protocol_details": {
"port": 5100
},
"attack_vector": "Sonde port \u00b7 port 5100 \u00b7 (sonde \/ probe)",
"target_port_label": "5100",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 5100,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 5100
},
"attack_vector": "Sonde port \u00b7 port 5100 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5100",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5100"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
21/07/2026 19:25:31 UTC
TCP
7041 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:7041 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 71
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7041
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 71
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:7041
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:7041 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Act
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "52a4c544e1b891907a0c2f887fbc55a1d4481c1c",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 952,
"payload_entropy": 5.673848043478651,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 7041,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 71,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "2cb03f221f0dce4e40cf6f0254448b21939e9c91",
"event_fingerprint": "11842edc746087decaab81b299485f93e8f6f59b",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "a8c27bb3da5ee4c87f4d314d349a06f0",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 7041,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Act",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Act",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "93f46864003eeb9b6f9b12b785e57211499c649f",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 7041,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"attack_vector": "http smuggling probe \u00b7 via HTTP:7041 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "7041 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7041,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 7041,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:7041 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"target_port_label": "7041 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:7041"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 19:25:31 UTC
TCP
7041 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:7041 · (tentative d'exploit) · → /app
Élevée
Élevé · 71
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7041
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 71
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:7041
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:7041 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533",
"http_host_hash": "52a4c544e1b891907a0c2f887fbc55a1d4481c1c",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 944,
"payload_entropy": 5.635049719158419,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 7041,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 71,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "db962a79281135a4ace8b69cc053db8f92f9dbaf",
"event_fingerprint": "126e811387fa0aa398c38fbdf105220d208ebfef",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3",
"payload_hash": "7ffafe5dd0bc737a13cca167c7575b02",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 7041,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d4d00762e29e3ab2aab906fbcd744cec57129272",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 7041,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "http smuggling probe \u00b7 via HTTP:7041 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "7041 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7041,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 7041,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:7041 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "7041 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:7041"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 19:25:31 UTC
TCP
7041 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:7041 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 71
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) Appl…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7041
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 71
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:7041
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:7041 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36 Ac
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
"http_host_hash": "52a4c544e1b891907a0c2f887fbc55a1d4481c1c",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 990,
"payload_entropy": 5.686908607132396,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 7041,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 71,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "d102357b0c5d3c4dd9dfff8e58ae92ad6010af85",
"event_fingerprint": "f3ce65514e89b3e7fa34e95fbad4874aa51ed238",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c772734c6eb2978096c283068906aec3",
"payload_hash": "1854dbafd8e5e40a5731701cd1b0db22",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 7041,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAc",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAc",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "68a900511ed7b1371259f27eec6e5fb106053167",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 7041,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"attack_vector": "http smuggling probe \u00b7 via HTTP:7041 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "7041 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7041,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 7041,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:7041 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"target_port_label": "7041 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:7041"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 19:25:29 UTC
TCP
7041 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:7041 · (tentative d'exploit) · → /_next
Élevée
Élevé · 71
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7041
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 71
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:7041
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; W
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:7041 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, deflate
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858",
"http_host_hash": "52a4c544e1b891907a0c2f887fbc55a1d4481c1c",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 953,
"payload_entropy": 5.668311922807437,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 7041,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 71,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "db962a79281135a4ace8b69cc053db8f92f9dbaf",
"event_fingerprint": "19d91da4a25e86414c24ff7ccacbed6b9ba9b2aa",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee",
"payload_hash": "1fd181915d5dd3ba885d3e2dfe2702df",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 7041,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\n",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\n",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b143b63eb238dd8abd3c720d5ab00c5f08bdec61",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 7041,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"attack_vector": "http smuggling probe \u00b7 via HTTP:7041 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "7041 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7041,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 7041,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:7041 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"target_port_label": "7041 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:7041"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 19:25:29 UTC
TCP
7041 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:7041 · (tentative d'exploit) · → /api
Élevée
Élevé · 71
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7041
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 71
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:7041
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86_64) A
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:7041 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-R
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd",
"http_host_hash": "52a4c544e1b891907a0c2f887fbc55a1d4481c1c",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 927,
"payload_entropy": 5.625535096091212,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 7041,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 71,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "e901a1a3363335df34ed071d1cc9ccbaf4191770",
"event_fingerprint": "ee38ea523635a5039a4fa029d7aa6139fd8f8e02",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "72d43eb808798db218d063798749cc39",
"payload_hash": "16536e823a83f7d3be9bb7e519629df1",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 7041,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-R",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-R",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3efe4c127778ad7e6c6d2d636034c168b4998f90",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 7041,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"attack_vector": "http smuggling probe \u00b7 via HTTP:7041 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "7041 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7041,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 7041,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:7041 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"target_port_label": "7041 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:7041"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 19:25:27 UTC
TCP
7041
—
Sonde port
Sonde port · port 7041 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
7041
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 7041,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 0.6,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "25004a5e337e4984ae6ea2805df3c536f80151f3",
"event_fingerprint": "c95f763b6b09ccb5fb58509505ae3eb56168d5e3",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 7041,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d3536e3709557371f38ad22ed55bffed0278ecae",
"protocol_details": {
"port": 7041
},
"attack_vector": "Sonde port \u00b7 port 7041 \u00b7 (sonde \/ probe)",
"target_port_label": "7041",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 7041,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 7041
},
"attack_vector": "Sonde port \u00b7 port 7041 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "7041",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "7041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
21/07/2026 19:25:27 UTC
TCP
7041 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:7041 · (tentative d'exploit)
Élevée
Élevé · 71
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
7041
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 71
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:7041
Content-Length: 508
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:7041 Content-Length: 508 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gzip, defla
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea",
"http_host_hash": "52a4c544e1b891907a0c2f887fbc55a1d4481c1c",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 944,
"payload_entropy": 5.660785695187678,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 7041,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 3.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 71,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "c20758847db4103dea0b028cc656bf69ff226410",
"event_fingerprint": "93baa38aeab72ca1570e375e4f88ed573af275c8",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6c8160595869adea51d6742918f57fdf",
"payload_hash": "7b8abf3ee12beec7454db211877551c7",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 7041,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7a2164cbc412b3a39788231bac079dfd1b924332",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 7041,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"attack_vector": "http smuggling probe \u00b7 via HTTP:7041 \u00b7 (tentative d'exploit)",
"target_port_label": "7041 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 71,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7041,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 7041,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:7041 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:7041\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"target_port_label": "7041 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7041"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:7041"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 18:30:24 UTC
TCP
5500 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5500 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5500
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:5500
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Macintosh;
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:5500 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate N
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a",
"http_host_hash": "d5ab7fa32d29570115e28396cdbd8369873b3cf0",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 959,
"payload_entropy": 5.660538058583704,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5500,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "c30cc949ad5f6fdc6343737dc8065f7c7a815aff",
"event_fingerprint": "c7f3da01306a0088f99b99501889ac6d7a228864",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de",
"payload_hash": "3de1f10571a60a6bbe0ac39af988b562",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 5500,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; ",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d44752748e16336007d093b70ea75e289287e1a2",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5500,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5500 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "5500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5500,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5500,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5500 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"target_port_label": "5500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5500"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 18:30:24 UTC
TCP
5500 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5500 · (tentative d'exploit) · → /app
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5500
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:5500
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 145
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:5500 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "d5ab7fa32d29570115e28396cdbd8369873b3cf0",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 936,
"payload_entropy": 5.633173428906528,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5500,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "5bedd826ddfaf73a171047b0106af908742232bd",
"event_fingerprint": "a1ba9eaa5fe5f5a08900511cb5eadfc51a38c51d",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "889f751f1a257e586cd528f7debe80a6",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 5500,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0d7c2c678d95055ced81a0a88e35fc641a3b4b1d",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5500,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5500 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "5500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5500,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5500,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5500 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"target_port_label": "5500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5500"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 18:30:24 UTC
TCP
5500 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5500 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5500
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:5500
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:5500 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Actio
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533",
"http_host_hash": "d5ab7fa32d29570115e28396cdbd8369873b3cf0",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 944,
"payload_entropy": 5.6577423996049125,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5500,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "212565084a22189db874d9a5c7c2e723f8528693",
"event_fingerprint": "227644d38226b7bf847c5d29647bc322e4421a43",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3",
"payload_hash": "2f2c0bb6069c9384c280069d4cb4ab08",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 5500,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7aad1979720fd0077c243de40caca854730ba048",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5500,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5500 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "5500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5500,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5500,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5500 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.",
"target_port_label": "5500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5500"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 18:30:23 UTC
TCP
5500 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5500 · (tentative d'exploit) · → /api
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5500
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:5500
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:5500 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Actio
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a",
"http_host_hash": "d5ab7fa32d29570115e28396cdbd8369873b3cf0",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 950,
"payload_entropy": 5.626723605238044,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5500,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "b916499d8ad0ceec531021542cba2994c774263c",
"event_fingerprint": "225b66eee18c989b99d8a69745928c48dec59af4",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de",
"payload_hash": "e17b94ded261c8850d8dfadc43fe945a",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 5500,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Actio",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b4cfd66eecf0d4d694ca60e28c97ee60a7dbecd9",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5500,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5500 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "5500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5500,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5500,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5500 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac",
"target_port_label": "5500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5500"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 18:30:22 UTC
TCP
5500 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5500 · (tentative d'exploit) · → /_next
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5500
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:5500
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; W
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:5500 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, deflate
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "a76e08b809549a8ef70acaf7074b5caa8a051858",
"http_host_hash": "d5ab7fa32d29570115e28396cdbd8369873b3cf0",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 960,
"payload_entropy": 5.6624311960382085,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5500,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "5bedd826ddfaf73a171047b0106af908742232bd",
"event_fingerprint": "52fb90e2f1831f015b1b378161247dbb23d27cd7",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "64a32e80cd1b4b7b1af4cc78f58848ee",
"payload_hash": "5188259454ae2b31b4963bc42a2724e1",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 5500,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\n",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, deflate\r\n",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ff6e2ca069f27b750b0444012aa31be5b1721b01",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 5500,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5500 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "5500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5500,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134\u2026",
"port": 5500,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5500 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; W",
"target_port_label": "5500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5500"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 18:30:20 UTC
TCP
5500
—
Sonde port
Sonde port · port 5500 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5500
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 5500,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "08e43664c01f4ddc873851b2fb2c3223bebb5f97",
"event_fingerprint": "52b8dc5cb92c52f96ee3d2734d686bb09c3f831b",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5500,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cec4be87a19f744a285ff8faca6df95446b507f2",
"protocol_details": {
"port": 5500
},
"attack_vector": "Sonde port \u00b7 port 5500 \u00b7 (sonde \/ probe)",
"target_port_label": "5500",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 5500,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 5500
},
"attack_vector": "Sonde port \u00b7 port 5500 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5500",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5500"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
21/07/2026 18:30:20 UTC
TCP
5500 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5500 · (tentative d'exploit)
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) Appl…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5500
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:5500
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWM
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:5500 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36 Accept-Enco
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
"http_host_hash": "d5ab7fa32d29570115e28396cdbd8369873b3cf0",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 981,
"payload_entropy": 5.688166777735049,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5500,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "1f6c2750c1510321d06a35b689548f74fa4b4002",
"event_fingerprint": "c150e018bc08b7e5e0dabeee242890844114f0c3",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c772734c6eb2978096c283068906aec3",
"payload_hash": "8c8598ec62a6bdce430a465550828d82",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 5500,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-Enco",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-Enco",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aee96e7e139264d6d03ace822a944c5e917a7285",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 5500,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5500 \u00b7 (tentative d'exploit)",
"target_port_label": "5500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5500,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 5500,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5500 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5500\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"target_port_label": "5500 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5500"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5500"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 18:17:31 UTC
TCP
9969 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:9969 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 74
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9969
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 74
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:9969
Content-Length: 512
Connection: close
User-Agent: Mozilla/5.0 (Linux; Andr
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:9969 Content-Length: 512 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Ne
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e",
"http_host_hash": "1465b66176880cbf7f406fc744dd7f0c8263d193",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 944,
"payload_entropy": 5.647724183094737,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 9969,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 74,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "d2bf75423db3f3e4701b9c6cec65747604938e33",
"event_fingerprint": "953c4a3174360b928a3be0f9506c92e8c88656fd",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966",
"payload_hash": "bda6617969200fa25fcf2a73a69b7064",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 9969,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNe",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNe",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5a5c3c3e8a75a31661e08778e2298013fb0aed1e",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 9969,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"attack_vector": "http smuggling probe \u00b7 via HTTP:9969 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "9969 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9969,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 9969,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:9969 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"target_port_label": "9969 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9969"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:9969"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 18:17:31 UTC
TCP
9969 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:9969 · (tentative d'exploit) · → /app
Élevée
Élevé · 74
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9969
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 74
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:9969
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:9969 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: poop1234 C
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "fac64969f9eca34262c56352be2d62dd2d22b1a0",
"http_host_hash": "1465b66176880cbf7f406fc744dd7f0c8263d193",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 899,
"payload_entropy": 5.600655328294004,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 9969,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 74,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "84604c0d05f398d0f824ef70ad3a6439464a89ea",
"event_fingerprint": "30cde727d21cb2d20bba2a822acff76806395ea6",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9f10b48170735feac18b44fa385fef37",
"payload_hash": "19498852bcaab7ce1976d25cc9e98b24",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 9969,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nC",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nC",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "118ed92c1f4aaf6567448ad9e4312f74678c182b",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 9969,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "http smuggling probe \u00b7 via HTTP:9969 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "9969 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9969,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 9969,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:9969 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "9969 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9969"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:9969"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 18:17:31 UTC
TCP
9969 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:9969 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 74
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9969
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 74
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:9969
Content-Length: 508
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; Andr
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:9969 Content-Length: 508 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gz
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea",
"http_host_hash": "1465b66176880cbf7f406fc744dd7f0c8263d193",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 953,
"payload_entropy": 5.6751613916539645,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 9969,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 74,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "dfa07326334e3dd0f4244241835d498f1a6a8949",
"event_fingerprint": "ae7984da37f1e962d2c44dd133184c38cdb0dc80",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6c8160595869adea51d6742918f57fdf",
"payload_hash": "27515bd8204873d4dee066f92d09fdf5",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 9969,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gz",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gz",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1068d27a1ffa5012e944557992fccfd5a569c795",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 9969,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
"attack_vector": "http smuggling probe \u00b7 via HTTP:9969 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "9969 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9969,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 9969,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:9969 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 508\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andr",
"target_port_label": "9969 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9969"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:9969"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 18:17:30 UTC
TCP
9969 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:9969 · (tentative d'exploit) · → /api
Élevée
Élevé · 74
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9969
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 74
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:9969
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 145
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:9969 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "1465b66176880cbf7f406fc744dd7f0c8263d193",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 943,
"payload_entropy": 5.666652736868483,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 9969,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 74,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "ec66f520fa2777d928ac0c4f45942455e1822e44",
"event_fingerprint": "848a4f0b98e95d945a1f023b09d7e809bd1e666d",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "e9c16aaed0fc73c2fac46132b529c764",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 9969,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "04c59f07555deb7932fbaf063f993da8ff6862a0",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 9969,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"attack_vector": "http smuggling probe \u00b7 via HTTP:9969 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "9969 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9969,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 9969,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:9969 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"target_port_label": "9969 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9969"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:9969"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 18:17:29 UTC
TCP
9969 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:9969 · (tentative d'exploit) · → /_next
Élevée
Élevé · 74
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9969
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 74
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:9969
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; Android
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:9969 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gzip,
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea",
"http_host_hash": "1465b66176880cbf7f406fc744dd7f0c8263d193",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 969,
"payload_entropy": 5.67186048847837,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 9969,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 74,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "84604c0d05f398d0f824ef70ad3a6439464a89ea",
"event_fingerprint": "aeef16ac61afd384a827830a86f8368e14dfd6d7",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6c8160595869adea51d6742918f57fdf",
"payload_hash": "d682a611e7314e592534a377da0521d2",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 9969,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android ",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, ",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, ",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "03bee344274d57a5f1b12bb55b5c99580ddb9f30",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 9969,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android",
"attack_vector": "http smuggling probe \u00b7 via HTTP:9969 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "9969 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9969,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 9969,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:9969 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android",
"target_port_label": "9969 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9969"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:9969"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 18:17:27 UTC
TCP
9969 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:9969 · (tentative d'exploit)
Élevée
Élevé · 74
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9969
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 74
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:9969
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 10; K) A
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:9969 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e",
"http_host_hash": "1465b66176880cbf7f406fc744dd7f0c8263d193",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 946,
"payload_entropy": 5.654565152856081,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 9969,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.9,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 74,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "423a89bc0c1b29fedfe012d4f22100248a21c1ce",
"event_fingerprint": "35a9f2664cc1937ea403240702b9edddb6e74524",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966",
"payload_hash": "8144d5b298b32571c30696fe0c2822f5",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9969,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bcfa905b204c6c68b8802f25bc25ba4d40150240",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 9969,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"attack_vector": "http smuggling probe \u00b7 via HTTP:9969 \u00b7 (tentative d'exploit)",
"target_port_label": "9969 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9969,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 9969,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:9969 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9969\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) A",
"target_port_label": "9969 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9969"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:9969"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 18:17:26 UTC
TCP
9969
—
Sonde port
Sonde port · port 9969 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9969
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 9969,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.9,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0f26f46d71ee7d082e8073807cdc126bfd90acc8",
"event_fingerprint": "c94ac3ca50ea0ccaa18748a332513107032f3f8e",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 9969,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1d9f6d5280847f30d8c28cdb6e1583dab9b4eb84",
"protocol_details": {
"port": 9969
},
"attack_vector": "Sonde port \u00b7 port 9969 \u00b7 (sonde \/ probe)",
"target_port_label": "9969",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9969,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 9969
},
"attack_vector": "Sonde port \u00b7 port 9969 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "9969",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9969"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
21/07/2026 17:46:10 UTC
TCP
4006 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:4006 · (tentative d'exploit) · → /app
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
4006
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:4006
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone O
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:4006 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-Encoding:
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe",
"http_host_hash": "8e0862bfbf240870df2c8b9ad22d5dbe7660fe0b",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 969,
"payload_entropy": 5.685413191328847,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 4006,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "db2c55c0e74c75e86677ce95893307a9aa26061e",
"event_fingerprint": "9890ae12851d525a46d85a0e524acb5cc68e752b",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b",
"payload_hash": "e962b33649356de4146e56dafbfdc032",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 4006,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:4006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:4006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: ",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:4006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:4006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: ",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:4006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f143dfd017ef1ae98ff45b9075f5cf58ebbf8d4f",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 4006,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:4006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"attack_vector": "http smuggling probe \u00b7 via HTTP:4006 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "4006 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4006,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 4006,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:4006 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:4006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone O",
"target_port_label": "4006 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4006"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:4006"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
21/07/2026 17:46:10 UTC
TCP
4006 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:4006 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
4006
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:4006
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; Int
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:4006 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a",
"http_host_hash": "8e0862bfbf240870df2c8b9ad22d5dbe7660fe0b",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 950,
"payload_entropy": 5.658213119592928,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 4006,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "53984997a681bd6ccb9e6b5344d268def5dc5818",
"event_fingerprint": "e3e560d75df989552819bc20f629f1a71eb1b9ff",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de",
"payload_hash": "7b9a32765b6f83dc5a145598f1752aad",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 4006,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1f6e830fdbdbb7046d66469578a3ad4e766c4555",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 4006,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"attack_vector": "http smuggling probe \u00b7 via HTTP:4006 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "4006 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4006,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 4006,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:4006 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:4006\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Int",
"target_port_label": "4006 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4006"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:4006"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}