19/07/2026 02:29:07 UTC
TCP
5601 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5601 · (tentative d'exploit) · → /app
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) Appl…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5601
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:5601
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 9; AF
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:5601 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36 Accept-E
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322",
"emulator_response_len": 163,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
"http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 971,
"payload_entropy": 5.6753113820829775,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5601,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "8fc6e9a26afe88077db7739bb21feee8249fe01d",
"event_fingerprint": "1b6d7f56a6e7c5327477ee43af28665cf2a50597",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c772734c6eb2978096c283068906aec3",
"payload_hash": "01f1afa39edd13c6c3e5c02fab9e5c34",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 5601,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-E",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-E",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d4307f5fd34f7748e4d0b4f63f0a9db9b6332f7b",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5601,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5601"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
19/07/2026 02:29:07 UTC
TCP
5601 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5601 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5601
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:5601
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:5601 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Ne
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322",
"emulator_response_len": 163,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd",
"http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 940,
"payload_entropy": 5.65779278889318,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5601,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 75,
"tag_count": 16,
"anomaly_count": 0,
"campaign_key": "0dc45312f39bb8ccfe53acc98178e9a04df909a6",
"event_fingerprint": "4c523129e66d1a24477877ff9a6b665b8075e014",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "72d43eb808798db218d063798749cc39",
"payload_hash": "a864afc873ae579ce2a94328cf7711e2",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 5601,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Ne",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Ne",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dfb23970ad01318563f15c8ebc52662c324c2ed0",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5601,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5601"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
19/07/2026 02:29:06 UTC
TCP
5601 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5601 · (tentative d'exploit) · → /api
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5601
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:5601
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:5601 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322",
"emulator_response_len": 163,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533",
"http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 931,
"payload_entropy": 5.63096154314556,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5601,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 75,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "7dec5a700a870f957a163d0973a205fc98e156f6",
"event_fingerprint": "71ee3ec75808247ca0bcaa7de218d7d0ded31e6a",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3",
"payload_hash": "8261dcd2635cbd5132dbe6895f850d73",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 5601,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7934f79aa7e8b3ef1695f180a01794bf737a624d",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5601,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5601"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
19/07/2026 02:29:05 UTC
TCP
5601 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5601 · (tentative d'exploit) · → /_next
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007;…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5601
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:5601
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 14;
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:5601 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322",
"emulator_response_len": 163,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1978af5307537775fab4b66b0f1439319be37ce1",
"http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 996,
"payload_entropy": 5.6552665517634155,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5601,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "8fc6e9a26afe88077db7739bb21feee8249fe01d",
"event_fingerprint": "59871bb22b849bcc2055d436083dbcb2126af16b",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7967be4fa492cfad4b86b41e3ae090e9",
"payload_hash": "a7aa204082d80b9e6492ea68ba9afceb",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 5601,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2bcede6f21f85c803af4708c097b423792ee4037",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5601,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5601"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
19/07/2026 02:29:03 UTC
TCP
5601 · KIBANA
kibana probe
kibana probe · via KIBANA:5601 · (sonde / probe)
Élevée
Faible · 24
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
KIBANA
WAF
—
Recommandation
Surveiller
Tags
kibana_emulated
net_kibana_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
5601
Chemin / cible
—
Pourquoi cette classification : Type « kibana_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 2 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322",
"emulator_response_len": 163,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "kibana",
"app_proto": "kibana",
"asn": 49870,
"country": "SC",
"dst_port": 5601,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0
},
"risk_score": 24,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "9b8c7063184af590e074e6367a10d303c5aaba60",
"event_fingerprint": "2e1f529c61b64068b719daaa760380b1c25ad6a1",
"classification_reason": "Type \u00ab kibana_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 24
},
"named_classification_skipped": false,
"service_name": "kibana",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "0f790dc1ffcf37cb597b3d4bfc47e511"
},
"target_context": {
"dst_port": 5601,
"service": "kibana",
"service_name": "kibana",
"risk_score": 24
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "49e0018bd203e5249266db0a881a3d5640577140",
"protocol_details": {
"port": 5601,
"service": "kibana",
"service_label_fr": "KIBANA"
},
"attack_vector": "kibana probe \u00b7 via KIBANA:5601 \u00b7 (sonde \/ probe)",
"target_port_label": "5601 \u00b7 KIBANA",
"emulator_service": "kibana",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab kibana_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab kibana_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 0,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": "kibana",
"service_label_fr": "KIBANA",
"dst_port": 5601,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-kibana",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 5601,
"service": "kibana",
"service_label_fr": "KIBANA"
},
"attack_vector": "kibana probe \u00b7 via KIBANA:5601 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5601 \u00b7 KIBANA",
"emulator_service": "kibana",
"confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "kibana",
"service_banner": "honeypot-kibana",
"service_os": "linux",
"dst_port": "5601"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"kibana_emulated",
"net_kibana_probe"
]
}
19/07/2026 02:29:03 UTC
TCP
5601 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:5601 · (tentative d'exploit)
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
5601
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:5601
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64;
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:5601 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: poop1234 Cont
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a6b626e2d6e616d653a20686f6e6579706f742d6b6962616e610d0a6b626e2d76657273696f6e3a20382e31312e300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2273746174757322",
"emulator_response_len": 163,
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "fac64969f9eca34262c56352be2d62dd2d22b1a0",
"http_host_hash": "0e6e37a3aba52797339f42933431830756a0515c",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 903,
"payload_entropy": 5.612925305416496,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 5601,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 75,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "ebf138f87a6bc01cddf30f20ae53857f8adba613",
"event_fingerprint": "925444dd1cc959b1f749442f957da8283bc2b716",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9f10b48170735feac18b44fa385fef37",
"payload_hash": "78a17fedb1611a75ee25d1519a0c2094",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 5601,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nCont",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nCont",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5143a817a1404625608e8d7722110641c15fc5b6",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"attack_vector": "http smuggling probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit)",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5601,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 5601,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:5601 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:5601\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64;",
"target_port_label": "5601 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5601"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"kibana"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti",
"net_web_probe"
]
}
19/07/2026 02:00:45 UTC
TCP
801 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:801 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
801
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:801
Content-Length: 507
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x8
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:801 Content-Length: 507 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Acti
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "7fcf178b2cbd7428736dd988ee2cc7c3810d4aa7",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 930,
"payload_entropy": 5.640930939132328,
"port_category": "well_known",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 801,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "09c1908f25e6c21047edd9adf2858a1d7d69a799",
"event_fingerprint": "ef1a9cbbe1865c55f7f190808e298681cd092d89",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "047ce5034650d469100e832cd94917f1",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 801,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x8",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Acti",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x8",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Acti",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x8",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fc9c963eb6f1bfe01fc490fcacd5bc7327e04770",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 801,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x8",
"attack_vector": "http smuggling probe \u00b7 via HTTP:801 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 801,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 801,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:801 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x8",
"target_port_label": "801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "801"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:801"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 02:00:45 UTC
TCP
801 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:801 · (tentative d'exploit) · → /app
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) Appl…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
801
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:801
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 9; AFT
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:801 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36 Accept-En
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
"http_host_hash": "7fcf178b2cbd7428736dd988ee2cc7c3810d4aa7",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 976,
"payload_entropy": 5.662016212948015,
"port_category": "well_known",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 801,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "c5894182eeeed82589bd4b06e5812f3c00b8d5ee",
"event_fingerprint": "3ceced220a31e9ac7e4018dcd59c5320924e36f8",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c772734c6eb2978096c283068906aec3",
"payload_hash": "94b6645b9e0b664718efab326acb37d2",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 801,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFT",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-En",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFT",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-En",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFT",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "745afcd95dcf54317ac451e1b592ace6c4ab23ed",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 801,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFT",
"attack_vector": "http smuggling probe \u00b7 via HTTP:801 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 801,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 801,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:801 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFT",
"target_port_label": "801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "801"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:801"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 02:00:45 UTC
TCP
801 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:801 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
801
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:801
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; Andro
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:801 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gzi
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea",
"http_host_hash": "7fcf178b2cbd7428736dd988ee2cc7c3810d4aa7",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 966,
"payload_entropy": 5.6679829790287855,
"port_category": "well_known",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 801,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "032327c5ef3f873217f2e3212a88cadbc11153f1",
"event_fingerprint": "b12c07de139b12117787d550b16e6c091c2aa1b5",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6c8160595869adea51d6742918f57fdf",
"payload_hash": "8efc328d9891ccd0728eb4963d8beda4",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 801,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andro",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzi",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andro",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzi",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andro",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "505d0709379be3e197c0b0064ebf90d93ec09cee",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 801,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andro",
"attack_vector": "http smuggling probe \u00b7 via HTTP:801 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 801,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 801,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:801 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Andro",
"target_port_label": "801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "801"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:801"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 02:00:44 UTC
TCP
801 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:801 · (tentative d'exploit) · → /api
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
801
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:801
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win6
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:801 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: poop1234 Co
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "fac64969f9eca34262c56352be2d62dd2d22b1a0",
"http_host_hash": "7fcf178b2cbd7428736dd988ee2cc7c3810d4aa7",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 911,
"payload_entropy": 5.574481342897507,
"port_category": "well_known",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 801,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "c83065d3251cfd14de2d869dea865e75b2312724",
"event_fingerprint": "7644cc2e3e1aea652a66445a856b8122835ff59e",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9f10b48170735feac18b44fa385fef37",
"payload_hash": "6ae3e3a9943606a56dafd21a60f155f6",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 801,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nCo",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nCo",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1703c61161e883d9586bc37897d9a98767984069",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 801,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"attack_vector": "http smuggling probe \u00b7 via HTTP:801 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 801,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 801,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:801 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win6",
"target_port_label": "801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "801"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:801"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 02:00:42 UTC
TCP
801 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:801 · (tentative d'exploit) · → /_next
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
801
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:801
Content-Length: 507
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:801 Content-Length: 507 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "0703723cf11531696e7769eb22f8d9b281390533",
"http_host_hash": "7fcf178b2cbd7428736dd988ee2cc7c3810d4aa7",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 924,
"payload_entropy": 5.645188637261731,
"port_category": "well_known",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 801,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "c5894182eeeed82589bd4b06e5812f3c00b8d5ee",
"event_fingerprint": "9f11231d938657848ae3fb115255ad3581d3c5e4",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c9d890423bdd8f672926a6e46bf361c3",
"payload_hash": "0b306ff835273682babce5c81c7abe24",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 801,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bd749df6a18b7c4a8acf125ba34806bdab914ad9",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 801,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"attack_vector": "http smuggling probe \u00b7 via HTTP:801 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 801,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 801,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:801 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 507\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"target_port_label": "801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "801"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:801"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 02:00:41 UTC
TCP
801
—
Sonde port
Sonde port · port 801 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
801
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 801,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "130904d133c5be2817dc5bbb91aec61fa95b931f",
"event_fingerprint": "ce383b8c82e742c984eab7ffac32fcc49ad089ed",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 801,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ef8b9e7705febd85ffed36bed1a12a2cd380eab0",
"protocol_details": {
"port": 801
},
"attack_vector": "Sonde port \u00b7 port 801 \u00b7 (sonde \/ probe)",
"target_port_label": "801",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 801,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 801
},
"attack_vector": "Sonde port \u00b7 port 801 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "801",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "801"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
19/07/2026 02:00:41 UTC
TCP
801 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:801 · (tentative d'exploit)
Élevée
Élevé · 75
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
801
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 75
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:801
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:801 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-Encoding: gzip
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe",
"http_host_hash": "7fcf178b2cbd7428736dd988ee2cc7c3810d4aa7",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 965,
"payload_entropy": 5.6775526407324,
"port_category": "well_known",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 801,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 7.2,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 75,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "0000fdc42cd3cfc3fc610ab4c309ebdaebc2702a",
"event_fingerprint": "e249fb4ee7cf585b8ba5e3343938a8abe30866b6",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b",
"payload_hash": "26219a2490d368d3a6cc402f2a3d41bc",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 801,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: gzip",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Encoding: gzip",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4ac78d4984b072d88e05e89f0c31283e29e93268",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 801,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17",
"attack_vector": "http smuggling probe \u00b7 via HTTP:801 \u00b7 (tentative d'exploit)",
"target_port_label": "801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 75,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 801,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 801,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:801 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:801\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17",
"target_port_label": "801 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "801"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:801"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 01:34:14 UTC
TCP
11111 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:11111 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
11111
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:11111
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Macintosh; In
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:11111 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Nex
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a",
"http_host_hash": "9126eb93850534145b6004433f95d794096ff46e",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 951,
"payload_entropy": 5.651941324067387,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 11111,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "37349cbc759ad3cd66672bbd25c466ff08868aa2",
"event_fingerprint": "13e624a6b8069976f310e7d94f31e503464b0149",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de",
"payload_hash": "d1eafa7b7f6eac37ffb35a4d8a4cc8ce",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 11111,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; In",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNex",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; In",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNex",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; In",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e65db1bf80148bdb4dcea9dfa5b3511b6358dd48",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 11111,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; In",
"attack_vector": "http smuggling probe \u00b7 via HTTP:11111 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "11111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 11111,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 11111,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:11111 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; In",
"target_port_label": "11111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "11111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:11111"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 01:34:13 UTC
TCP
11111 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:11111 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
11111
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:11111
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; And
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:11111 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate N
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e",
"http_host_hash": "9126eb93850534145b6004433f95d794096ff46e",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 953,
"payload_entropy": 5.62305905358023,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 11111,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "3cbe26fd68a94d42bfae4b1ed8194cab6d12bac2",
"event_fingerprint": "415587c188673890fd79cfe7a80d5ec894e74f11",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966",
"payload_hash": "7b9f4469422b6a11752020bdc3202941",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 11111,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; And",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; And",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; And",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8ae3bbb5fbe9e105cef7a9ff6a92149eceda12e9",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 11111,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; And",
"attack_vector": "http smuggling probe \u00b7 via HTTP:11111 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "11111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 11111,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 11111,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:11111 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; And",
"target_port_label": "11111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "11111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:11111"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 01:34:13 UTC
TCP
11111 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:11111 · (tentative d'exploit) · → /app
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) Appl…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
11111
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:11111
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 9; A
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:11111 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36 Accept-
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
"http_host_hash": "9126eb93850534145b6004433f95d794096ff46e",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 979,
"payload_entropy": 5.670249993031549,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 11111,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "4aefb6a193b22bfdce0cfac747542cd311479876",
"event_fingerprint": "03c3295fd83f2d5c7e69290c7e019d6d3a43e3e9",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c772734c6eb2978096c283068906aec3",
"payload_hash": "4e1fd8417ebd86eda65982049c9d9de5",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 11111,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; A",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; A",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; A",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b3e165e11cf78924288fd51d9e4396ac0e82416c",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 11111,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; A",
"attack_vector": "http smuggling probe \u00b7 via HTTP:11111 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "11111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 11111,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 11111,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:11111 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; A",
"target_port_label": "11111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "11111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:11111"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 01:34:12 UTC
TCP
11111 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:11111 · (tentative d'exploit) · → /api
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007;…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
11111
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:11111
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 14;
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:11111 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.3
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1978af5307537775fab4b66b0f1439319be37ce1",
"http_host_hash": "9126eb93850534145b6004433f95d794096ff46e",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 988,
"payload_entropy": 5.695047863898759,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 11111,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "2d8b3e8b4d7465c08407327471b85c27926bae8b",
"event_fingerprint": "0fb30a62e05bdcc5a92b7b93e53109cd6e0a92c2",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7967be4fa492cfad4b86b41e3ae090e9",
"payload_hash": "ab1353dbce2a9c30a9bceca850c6d832",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 11111,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; ",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.3",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.3",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0943e4bc1a95b30465e6abb176d932df4b8056d7",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 11111,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"attack_vector": "http smuggling probe \u00b7 via HTTP:11111 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "11111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 11111,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 11111,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:11111 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14;",
"target_port_label": "11111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "11111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:11111"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 01:34:11 UTC
TCP
11111 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:11111 · (tentative d'exploit) · → /_next
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
11111
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:11111
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_64
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:11111 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "9126eb93850534145b6004433f95d794096ff46e",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 939,
"payload_entropy": 5.63832466112191,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 11111,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "4aefb6a193b22bfdce0cfac747542cd311479876",
"event_fingerprint": "e75fde460ed709c53d023244f112cfc3fe6ee91b",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "c61174152edcbcee9ec6a43b98a24706",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 11111,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 ",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "16b8218ccdc53b94a303d52bced1d204da2ef6f2",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 11111,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64",
"attack_vector": "http smuggling probe \u00b7 via HTTP:11111 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "11111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 11111,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 11111,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:11111 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64",
"target_port_label": "11111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "11111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:11111"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 01:34:10 UTC
TCP
11111 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:11111 · (tentative d'exploit)
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
11111
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:11111
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 10; K)
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:11111 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-Action:
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e",
"http_host_hash": "9126eb93850534145b6004433f95d794096ff46e",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 934,
"payload_entropy": 5.633558091166907,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 11111,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "3060c35e5e5d4a200dfb0656eaa5d295ec409c4c",
"event_fingerprint": "d0c9244627b5740d31d66593ba1dbd8dae432a33",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966",
"payload_hash": "f0bcb953a934ab0e70bdc890162a5a80",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 11111,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) ",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: ",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K)",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: ",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K)",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "607d801c64be3106cb85c5a972c36035724a2e01",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 11111,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K)",
"attack_vector": "http smuggling probe \u00b7 via HTTP:11111 \u00b7 (tentative d'exploit)",
"target_port_label": "11111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 11111,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 11111,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:11111 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:11111\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K)",
"target_port_label": "11111 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "11111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:11111"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 01:34:09 UTC
TCP
11111
—
Sonde port
Sonde port · port 11111 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
11111
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 11111,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.1,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "33cf6c63ecfd793e632d14e9999bb56e5fad8fda",
"event_fingerprint": "d5b08d44db1d8470ec1e866388c40b30316ef04e",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 11111,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fd22b08f2df5aca61162bfe67c80100799e4dd29",
"protocol_details": {
"port": 11111
},
"attack_vector": "Sonde port \u00b7 port 11111 \u00b7 (sonde \/ probe)",
"target_port_label": "11111",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 11111,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 11111
},
"attack_vector": "Sonde port \u00b7 port 11111 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "11111",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "11111"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
19/07/2026 01:16:34 UTC
TCP
12345 · NETBUS
Sonde HTTP smuggling
http smuggling probe · via NETBUS:12345 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
NETBUS
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
12345
Chemin / cible
—
Service
NETBUS
Payload
POST /_next/server HTTP/1.1 Host: 62.3.50.33:12345 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:12345
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Windows NT
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:12345 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0 Accept-Encoding: gzip, d
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206e657462757320726561647920706f72743d31323334350d0a",
"emulator_response_len": 38,
"bytes_in": 968,
"payload_entropy": 5.6558145389769425,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "netbus",
"app_proto": "netbus",
"asn": 49870,
"country": "SC",
"dst_port": 12345,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c19fd32279774dc6e8d90203f5dbeef9c6c5e9fe",
"event_fingerprint": "4e74698fe2fcb538405d3ea87b5725c2dd122d5d",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "netbus",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "136df6c0973939f5ba7ed04db5feafbc",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 12345,
"service": "netbus",
"service_name": "netbus",
"risk_score": 52
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, d",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"evidence": {
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36 Edg\/134.0.0.0\r\nAccept-Encoding: gzip, d",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "27ad6fdf27644e2c0324d01f9c05ba1e73ca2345",
"protocol_details": {
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"port": 12345,
"service": "netbus",
"service_label_fr": "NETBUS"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"attack_vector": "http smuggling probe \u00b7 via NETBUS:12345 \u00b7 (tentative d'exploit)",
"target_port_label": "12345 \u00b7 NETBUS",
"emulator_service": "netbus",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via NETBUS",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "netbus",
"service_label_fr": "NETBUS",
"dst_port": 12345,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-netbus",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"port": 12345,
"service": "netbus",
"service_label_fr": "NETBUS"
},
"attack_vector": "http smuggling probe \u00b7 via NETBUS:12345 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT",
"target_port_label": "12345 \u00b7 NETBUS",
"emulator_service": "netbus",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "netbus",
"service_banner": "honeypot-netbus",
"service_os": "linux",
"dst_port": "12345"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
19/07/2026 01:16:34 UTC
TCP
12345 · NETBUS
Sonde HTTP smuggling
http smuggling probe · via NETBUS:12345 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
NETBUS
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
12345
Chemin / cible
—
Service
NETBUS
Payload
POST /app HTTP/1.1 Host: 62.3.50.33:12345 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:12345
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:12345 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206e657462757320726561647920706f72743d31323334350d0a",
"emulator_response_len": 38,
"bytes_in": 937,
"payload_entropy": 5.6215584276825865,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "netbus",
"app_proto": "netbus",
"asn": 49870,
"country": "SC",
"dst_port": 12345,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c19fd32279774dc6e8d90203f5dbeef9c6c5e9fe",
"event_fingerprint": "4e74698fe2fcb538405d3ea87b5725c2dd122d5d",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "netbus",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5dabaf97791363eca8787490452ac36d",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 12345,
"service": "netbus",
"service_name": "netbus",
"risk_score": 52
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14",
"evidence": {
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\n",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "05f1940fa42657cdcce5f803a0b65fff273dfa67",
"protocol_details": {
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14",
"port": 12345,
"service": "netbus",
"service_label_fr": "NETBUS"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14",
"attack_vector": "http smuggling probe \u00b7 via NETBUS:12345 \u00b7 (tentative d'exploit)",
"target_port_label": "12345 \u00b7 NETBUS",
"emulator_service": "netbus",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via NETBUS",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "netbus",
"service_label_fr": "NETBUS",
"dst_port": 12345,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-netbus",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14",
"port": 12345,
"service": "netbus",
"service_label_fr": "NETBUS"
},
"attack_vector": "http smuggling probe \u00b7 via NETBUS:12345 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14",
"target_port_label": "12345 \u00b7 NETBUS",
"emulator_service": "netbus",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "netbus",
"service_banner": "honeypot-netbus",
"service_os": "linux",
"dst_port": "12345"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
19/07/2026 01:16:34 UTC
TCP
12345 · NETBUS
Sonde HTTP smuggling
http smuggling probe · via NETBUS:12345 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
NETBUS
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
12345
Chemin / cible
—
Service
NETBUS
Payload
POST /api/route HTTP/1.1 Host: 62.3.50.33:12345 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; U; And
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:12345
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; And
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:12345 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: g
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206e657462757320726561647920706f72743d31323334350d0a",
"emulator_response_len": 38,
"bytes_in": 967,
"payload_entropy": 5.660538829331282,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "netbus",
"app_proto": "netbus",
"asn": 49870,
"country": "SC",
"dst_port": 12345,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c19fd32279774dc6e8d90203f5dbeef9c6c5e9fe",
"event_fingerprint": "4e74698fe2fcb538405d3ea87b5725c2dd122d5d",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "netbus",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8518733f11c55ceceb9addb161fbfd9f",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 12345,
"service": "netbus",
"service_name": "netbus",
"risk_score": 52
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; And",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: g",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; And",
"evidence": {
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: g",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; And",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ecb1492a0516ce74f6e63cf4a4321d8bc1bfd07a",
"protocol_details": {
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; And",
"port": 12345,
"service": "netbus",
"service_label_fr": "NETBUS"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; And",
"attack_vector": "http smuggling probe \u00b7 via NETBUS:12345 \u00b7 (tentative d'exploit)",
"target_port_label": "12345 \u00b7 NETBUS",
"emulator_service": "netbus",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via NETBUS",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "netbus",
"service_label_fr": "NETBUS",
"dst_port": 12345,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-netbus",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; And",
"port": 12345,
"service": "netbus",
"service_label_fr": "NETBUS"
},
"attack_vector": "http smuggling probe \u00b7 via NETBUS:12345 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; And",
"target_port_label": "12345 \u00b7 NETBUS",
"emulator_service": "netbus",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "netbus",
"service_banner": "honeypot-netbus",
"service_os": "linux",
"dst_port": "12345"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
19/07/2026 01:16:33 UTC
TCP
12345 · NETBUS
Sonde HTTP smuggling
http smuggling probe · via NETBUS:12345 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
NETBUS
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
12345
Chemin / cible
—
Service
NETBUS
Payload
POST /api HTTP/1.1 Host: 62.3.50.33:12345 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:12345
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Wi
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:12345 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: poop1234
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206e657462757320726561647920706f72743d31323334350d0a",
"emulator_response_len": 38,
"bytes_in": 913,
"payload_entropy": 5.640472454782347,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "netbus",
"app_proto": "netbus",
"asn": 49870,
"country": "SC",
"dst_port": 12345,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c19fd32279774dc6e8d90203f5dbeef9c6c5e9fe",
"event_fingerprint": "4e74698fe2fcb538405d3ea87b5725c2dd122d5d",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "netbus",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "52486885626d516a7e8ede39f396e4b2",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 12345,
"service": "netbus",
"service_name": "netbus",
"risk_score": 52
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\n",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"evidence": {
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\n",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f41cf30089399ea3d85c21ba2f16d13d35d30e03",
"protocol_details": {
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"port": 12345,
"service": "netbus",
"service_label_fr": "NETBUS"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"attack_vector": "http smuggling probe \u00b7 via NETBUS:12345 \u00b7 (tentative d'exploit)",
"target_port_label": "12345 \u00b7 NETBUS",
"emulator_service": "netbus",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via NETBUS",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "netbus",
"service_label_fr": "NETBUS",
"dst_port": 12345,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-netbus",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"port": 12345,
"service": "netbus",
"service_label_fr": "NETBUS"
},
"attack_vector": "http smuggling probe \u00b7 via NETBUS:12345 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Wi",
"target_port_label": "12345 \u00b7 NETBUS",
"emulator_service": "netbus",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "netbus",
"service_banner": "honeypot-netbus",
"service_os": "linux",
"dst_port": "12345"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
19/07/2026 01:16:32 UTC
TCP
12345 · NETBUS
Sonde HTTP smuggling
http smuggling probe · via NETBUS:12345 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
NETBUS
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
12345
Chemin / cible
—
Service
NETBUS
Payload
POST /_next HTTP/1.1 Host: 62.3.50.33:12345 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:12345
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86_64
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:12345 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Nextj
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206e657462757320726561647920706f72743d31323334350d0a",
"emulator_response_len": 38,
"bytes_in": 931,
"payload_entropy": 5.614182678191838,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "netbus",
"app_proto": "netbus",
"asn": 49870,
"country": "SC",
"dst_port": 12345,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c19fd32279774dc6e8d90203f5dbeef9c6c5e9fe",
"event_fingerprint": "4e74698fe2fcb538405d3ea87b5725c2dd122d5d",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "netbus",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "90494b7dcd215c2482ba00cf1467ecaa",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 12345,
"service": "netbus",
"service_name": "netbus",
"risk_score": 52
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextj",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"evidence": {
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextj",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6ef81352c6babf67ab297872e8de9a4c10e3653f",
"protocol_details": {
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"port": 12345,
"service": "netbus",
"service_label_fr": "NETBUS"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"attack_vector": "http smuggling probe \u00b7 via NETBUS:12345 \u00b7 (tentative d'exploit)",
"target_port_label": "12345 \u00b7 NETBUS",
"emulator_service": "netbus",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via NETBUS",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "netbus",
"service_label_fr": "NETBUS",
"dst_port": 12345,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-netbus",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"port": 12345,
"service": "netbus",
"service_label_fr": "NETBUS"
},
"attack_vector": "http smuggling probe \u00b7 via NETBUS:12345 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64",
"target_port_label": "12345 \u00b7 NETBUS",
"emulator_service": "netbus",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "netbus",
"service_banner": "honeypot-netbus",
"service_os": "linux",
"dst_port": "12345"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
19/07/2026 01:16:31 UTC
TCP
12345 · NETBUS
Sonde HTTP smuggling
http smuggling probe · via NETBUS:12345 · (tentative d'exploit)
Élevée
Moyen · 52
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
NETBUS
WAF
—
Recommandation
Investiguer
Tags
mozi_pattern
net_mozi_pattern
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
12345
Chemin / cible
—
Service
NETBUS
Payload
POST / HTTP/1.1 Host: 62.3.50.33:12345 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
User-Agent
—
Règles WAF
—
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:12345
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 14; SM-
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:12345 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206e657462757320726561647920706f72743d31323334350d0a",
"emulator_response_len": 38,
"bytes_in": 986,
"payload_entropy": 5.700873360625986,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "netbus",
"app_proto": "netbus",
"asn": 49870,
"country": "SC",
"dst_port": 12345,
"risk_waf": 8,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 30,
"risk_novelty": 15,
"risk_boost": 20,
"risk_granularity": 1.8,
"risk_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15
},
"risk_score": 52,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "c19fd32279774dc6e8d90203f5dbeef9c6c5e9fe",
"event_fingerprint": "4e74698fe2fcb538405d3ea87b5725c2dd122d5d",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"named_classification_skipped": false,
"service_name": "netbus",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "701ed9335971106812aeeffd5deb50ae",
"path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
},
"target_context": {
"dst_port": 12345,
"service": "netbus",
"service_name": "netbus",
"risk_score": 52
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36\r\n",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-",
"evidence": {
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36\r\n",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0a408edac841edb0a4095ae672acae67c29c67d2",
"protocol_details": {
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-",
"port": 12345,
"service": "netbus",
"service_label_fr": "NETBUS"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-",
"attack_vector": "http smuggling probe \u00b7 via NETBUS:12345 \u00b7 (tentative d'exploit)",
"target_port_label": "12345 \u00b7 NETBUS",
"emulator_service": "netbus",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via NETBUS",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 8,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 30,
"novelty": 15,
"risk_score": 52
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 52,
"risk_label": "Moyen",
"service_name": "netbus",
"service_label_fr": "NETBUS",
"dst_port": 12345,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-netbus",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-",
"port": 12345,
"service": "netbus",
"service_label_fr": "NETBUS"
},
"attack_vector": "http smuggling probe \u00b7 via NETBUS:12345 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:12345\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-",
"target_port_label": "12345 \u00b7 NETBUS",
"emulator_service": "netbus",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "netbus",
"service_banner": "honeypot-netbus",
"service_os": "linux",
"dst_port": "12345"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"mozi_pattern",
"net_mozi_pattern"
]
}
19/07/2026 01:16:30 UTC
TCP
12345 · NETBUS
netbus
netbus · via NETBUS:12345 · (sonde / probe)
Faible
Faible · 0
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
NETBUS
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
12345
Chemin / cible
—
Pourquoi cette classification : Type « netbus » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 0
Confiance : Confiance faible (0 %) — classification prudente
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "32323020686f6e6579706f74206e657462757320726561647920706f72743d31323334350d0a",
"emulator_response_len": 38,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "netbus",
"app_proto": "netbus",
"asn": 49870,
"country": "SC",
"dst_port": 12345,
"risk_waf": 8,
"risk_classification": 0,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 22,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0
},
"risk_score": 0,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "4cd39d557ac9329acf39a79a82bb68a56866acc0",
"event_fingerprint": "c6571097010435c153412a411c447fe1f59a908c",
"classification_reason": "Type \u00ab netbus \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"named_classification_skipped": false,
"service_name": "netbus",
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "468401074b03b78a88c623408feffd46"
},
"target_context": {
"dst_port": 12345,
"service": "netbus",
"service_name": "netbus",
"risk_score": 0
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bda9d983867225bffad3dacc95b1388a315a69ad",
"protocol_details": {
"port": 12345,
"service": "netbus",
"service_label_fr": "NETBUS"
},
"attack_vector": "netbus \u00b7 via NETBUS:12345 \u00b7 (sonde \/ probe)",
"target_port_label": "12345 \u00b7 NETBUS",
"emulator_service": "netbus",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab netbus \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab netbus \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 0,
"behavior": 0,
"geo": 0,
"protocol": 22,
"novelty": 0,
"risk_score": 0
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 0,
"risk_label": "Faible",
"service_name": "netbus",
"service_label_fr": "NETBUS",
"dst_port": 12345,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-netbus",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 12345,
"service": "netbus",
"service_label_fr": "NETBUS"
},
"attack_vector": "netbus \u00b7 via NETBUS:12345 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "12345 \u00b7 NETBUS",
"emulator_service": "netbus",
"confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "netbus",
"service_banner": "honeypot-netbus",
"service_os": "linux",
"dst_port": "12345"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
19/07/2026 00:49:49 UTC
TCP
9033 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:9033 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9033
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:9033
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:9033 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Act
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "1ae26aeaaea73498730e1bfe0bbb5229dd130052",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 952,
"payload_entropy": 5.662268023624854,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 9033,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "598fb32efbb7f4ba2ddf428285bc7133faaae4b0",
"event_fingerprint": "7a953cd2b52e6ae0338477b18d030abfc14b06c2",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "3b6dc036ab10afa2e3a56e7d4207a107",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 9033,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Act",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Act",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "77633c6a4ffa98b9387fa6aa015519570fa07b8b",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 9033,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"attack_vector": "http smuggling probe \u00b7 via HTTP:9033 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "9033 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9033,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 9033,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:9033 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x",
"target_port_label": "9033 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9033"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:9033"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 00:49:49 UTC
TCP
9033 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:9033 · (tentative d'exploit) · → /app
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9033
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:9033
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86_64) A
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:9033 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-R
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd",
"http_host_hash": "1ae26aeaaea73498730e1bfe0bbb5229dd130052",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 928,
"payload_entropy": 5.66404097099126,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 9033,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "8683bf4c15bbfa4de6f14521144838d31c552b77",
"event_fingerprint": "db460cb13da2e7b90d86b154f6a8cff4fe8bfcb6",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "72d43eb808798db218d063798749cc39",
"payload_hash": "ec79623e01ac1c8f225602a2f83cc120",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 9033,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-R",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-R",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "689ab70b876d2d540662bf6371217f228d8263ed",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 9033,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"attack_vector": "http smuggling probe \u00b7 via HTTP:9033 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "9033 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9033,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 9033,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:9033 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) A",
"target_port_label": "9033 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9033"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:9033"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 00:49:49 UTC
TCP
9033 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:9033 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) Appl…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9033
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:9033
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:9033 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36 Ac
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
"http_host_hash": "1ae26aeaaea73498730e1bfe0bbb5229dd130052",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 984,
"payload_entropy": 5.668869902143273,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 9033,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "efe0814f26a7ac6ddc384a5964787f16bf7d6292",
"event_fingerprint": "6af254516ac7ad1811f846b23510ef5b6b9902b6",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c772734c6eb2978096c283068906aec3",
"payload_hash": "3942e28c8278cc16312ee73a51111071",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 9033,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAc",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAc",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "71299ead49400089876bd79ab64a742af2de8bb9",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 9033,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"attack_vector": "http smuggling probe \u00b7 via HTTP:9033 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "9033 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9033,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 9033,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:9033 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android",
"target_port_label": "9033 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9033"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:9033"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 00:49:48 UTC
TCP
9033 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:9033 · (tentative d'exploit) · → /api
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) Appl…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9033
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:9033
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 9; AF
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:9033 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36 Accept-E
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
"http_host_hash": "1ae26aeaaea73498730e1bfe0bbb5229dd130052",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 978,
"payload_entropy": 5.670891736648072,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 9033,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "ae083dc16f4cfd3a64e895690154aca995a806ff",
"event_fingerprint": "c5f0311515424799123fe4b2dd670acd0ca6de6c",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c772734c6eb2978096c283068906aec3",
"payload_hash": "e5b2b11b2e46bd25730a803d6911d12d",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 9033,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-E",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-E",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7f9347c5d86fe2dde6f823d769612ce47cdebc0b",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 9033,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF",
"attack_vector": "http smuggling probe \u00b7 via HTTP:9033 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "9033 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9033,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 9033,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:9033 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AF",
"target_port_label": "9033 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9033"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:9033"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 00:49:46 UTC
TCP
9033 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:9033 · (tentative d'exploit) · → /_next
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9033
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:9033
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 1
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:9033 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "1ae26aeaaea73498730e1bfe0bbb5229dd130052",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 945,
"payload_entropy": 5.650015124764676,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 9033,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "8683bf4c15bbfa4de6f14521144838d31c552b77",
"event_fingerprint": "0bf1c0df4d7cb5352a63fd74f8ab64941b10a539",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "a288fed90418ca3238058cea1aec3a54",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 9033,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2727aaff8bd651f688bcda02858aa57b5bbb8756",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 9033,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1",
"attack_vector": "http smuggling probe \u00b7 via HTTP:9033 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "9033 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9033,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 9033,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:9033 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 1",
"target_port_label": "9033 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9033"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:9033"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 00:49:45 UTC
TCP
9033
—
Sonde port
Sonde port · port 9033 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
9033
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 9033,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.9,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "30d8c2eba1e3de4e57a28cfa4d9a4ea192d93fa4",
"event_fingerprint": "701f9ac4f751148af4c05c6d233df03a9c7934ee",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 9033,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "68dc129d0ce19bdab54419c231a4f48fe9784f74",
"protocol_details": {
"port": 9033
},
"attack_vector": "Sonde port \u00b7 port 9033 \u00b7 (sonde \/ probe)",
"target_port_label": "9033",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 9033,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 9033
},
"attack_vector": "Sonde port \u00b7 port 9033 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "9033",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "9033"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
19/07/2026 00:49:45 UTC
TCP
9033 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:9033 · (tentative d'exploit)
Élevée
Élevé · 73
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9033
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 73
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:9033
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:9033 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gzip, defla
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea",
"http_host_hash": "1ae26aeaaea73498730e1bfe0bbb5229dd130052",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 958,
"payload_entropy": 5.687531975804995,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 9033,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.9,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 73,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "2d2b9abfaf5bdf19590cc0d3983af7e1f0280b15",
"event_fingerprint": "3d4c3b06de6ca14f8da3ea75d776ba35334fe8b9",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6c8160595869adea51d6742918f57fdf",
"payload_hash": "f4abc7821226e4cc322bb2ebe14ec5f6",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 9033,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, defla",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "42d01957362bbfde5dafe8b368493f64df9ce8c3",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 9033,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"attack_vector": "http smuggling probe \u00b7 via HTTP:9033 \u00b7 (tentative d'exploit)",
"target_port_label": "9033 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 73,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9033,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 9033,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:9033 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:9033\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2",
"target_port_label": "9033 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9033"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:9033"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 00:19:24 UTC
TCP
8098 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8098 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8098
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:8098
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:8098 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd",
"http_host_hash": "85c47ddeb33f86ad31706848f828b6c859fd8929",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 943,
"payload_entropy": 5.661707783563239,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8098,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "45706ef9363ff71a06649bf7946afdfb67fb522e",
"event_fingerprint": "7ae2ac4be167705ea43e01d0644492133c75b354",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "72d43eb808798db218d063798749cc39",
"payload_hash": "ffbc06e8dd148586519f129b06fd456e",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 8098,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux ",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4cdcf8a755820bc58b215cc4f07b6abe3d7ae62f",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8098,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8098 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "8098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8098,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8098,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8098 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux",
"target_port_label": "8098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:8098"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 00:19:24 UTC
TCP
8098 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8098 · (tentative d'exploit) · → /app
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8098
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:8098
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 10; K
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:8098 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-Action
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e",
"http_host_hash": "85c47ddeb33f86ad31706848f828b6c859fd8929",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 943,
"payload_entropy": 5.663152534034231,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8098,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "0467072d2f4baa7fea6c90903f1b735e7364178b",
"event_fingerprint": "fb6ef85507684596fe105420674be365d81158e7",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966",
"payload_hash": "4d3b8150c170ea06b081292462b6790c",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 8098,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7ef65fc10688b53ad80b22cd030640bec95049a0",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 8098,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8098 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "8098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8098,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 8098,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8098 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"target_port_label": "8098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:8098"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 00:19:24 UTC
TCP
8098 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8098 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWeb…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8098
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:8098
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (iPhone; CPU iP
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:8098 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.6998.99 Mobile/15E148 Safari/604.1 Accept-Enco
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "affd667937319ba36aa098ac5e3b53f4e282c1fe",
"http_host_hash": "85c47ddeb33f86ad31706848f828b6c859fd8929",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 975,
"payload_entropy": 5.677711018346457,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8098,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "f7fd51346cd2cdc7361ecf679460a392798b3a5e",
"event_fingerprint": "343d4f402ca9bed5703c91a6beeef2258e217520",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6990db627a3d5a6ae3f8a2c22924225b",
"payload_hash": "68f1d643f6cbef0678bac72b62faba83",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 8098,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iP",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Enco",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iP",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mobile\/15E148 Safari\/604.1\r\nAccept-Enco",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iP",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5f88bf5474875fc76ac3b427c89311bd2d36c980",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 8098,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iP",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8098 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "8098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8098,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit\/605.1.15 (KHTML, like Gecko) CriOS\/134.0.6998.99 Mob\u2026",
"port": 8098,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8098 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (iPhone; CPU iP",
"target_port_label": "8098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:8098"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 00:19:22 UTC
TCP
8098 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8098 · (tentative d'exploit) · → /api
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8098
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:8098
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 145
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:8098 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "85c47ddeb33f86ad31706848f828b6c859fd8929",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 937,
"payload_entropy": 5.668232144695276,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8098,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "ae46e523eec3e42ba893f46f59d3fed819505f86",
"event_fingerprint": "afcbf0523601e8125c754d2c31ae742bcb22621f",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "111fbdb3fc4e50555249d927e3717f8a",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 8098,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "12b1dfb2291fb84339df7aab773ff60a9a7bc2b8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8098,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8098 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "8098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8098,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8098,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8098 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 145",
"target_port_label": "8098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:8098"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 00:19:21 UTC
TCP
8098 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8098 · (tentative d'exploit) · → /_next
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8098
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:8098
Content-Length: 513
Connection: close
User-Agent: Mozilla/5.0 (X11; Linux x86_64)
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:8098 Content-Length: 513 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "1c1f86ba252c0c8ebc250acab48718f12d6d1efd",
"http_host_hash": "85c47ddeb33f86ad31706848f828b6c859fd8929",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 923,
"payload_entropy": 5.651017316993656,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8098,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "0467072d2f4baa7fea6c90903f1b735e7364178b",
"event_fingerprint": "808fd31a006b8635f69c4c1195ca7f5857846076",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "72d43eb808798db218d063798749cc39",
"payload_hash": "b789c4fe2b95784bea38274d58db3e9b",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 8098,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "568034f3c26683a33c275ac376151dbd38db6705",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8098,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8098 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "8098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8098,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 8098,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8098 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 513\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64)",
"target_port_label": "8098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:8098"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
19/07/2026 00:19:20 UTC
TCP
8098
—
Sonde port
Sonde port · port 8098 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
8098
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 8098,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "18b1d37f24689d370c30c67a4eaac46a62c3fc18",
"event_fingerprint": "5a3a83d0b8dcdab5b026e45fd1b213e892d92609",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 8098,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "294c16555f773eb90d66347a49b6197a9e3e1e25",
"protocol_details": {
"port": 8098
},
"attack_vector": "Sonde port \u00b7 port 8098 \u00b7 (sonde \/ probe)",
"target_port_label": "8098",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 8098,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 8098
},
"attack_vector": "Sonde port \u00b7 port 8098 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8098",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "8098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
19/07/2026 00:19:20 UTC
TCP
8098 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8098 · (tentative d'exploit)
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007;…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8098
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:8098
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:8098 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 14; SM-F9560 Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/127.0.6533.103 Mobile Safari/537.36 A
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "1978af5307537775fab4b66b0f1439319be37ce1",
"http_host_hash": "85c47ddeb33f86ad31706848f828b6c859fd8929",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 985,
"payload_entropy": 5.684267427889252,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 8098,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "6740df2982ac3b0db99f59cfb2e7b2b323fb5c9c",
"event_fingerprint": "4b8d67420691fea5729451948c4fcbb0b62590d6",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "7967be4fa492cfad4b86b41e3ae090e9",
"payload_hash": "5edc6aa1250fb57e60fa893d9f0f7a90",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8098,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36\r\nA",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/127.0.6533.103 Mobile Safari\/537.36\r\nA",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ed4864575e75d0e66ad6fac0cdd30bb60577a424",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 8098,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8098 \u00b7 (tentative d'exploit)",
"target_port_label": "8098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8098,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 14; SM-F9560 Build\/UP1A.231005.007; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 \u2026",
"port": 8098,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8098 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:8098\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 14; SM-F",
"target_port_label": "8098 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8098"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:8098"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
18/07/2026 23:22:51 UTC
TCP
2001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:2001 · (tentative d'exploit) · → /api/route
Élevée
Élevé · 74
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/route UA Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KH…
Émulateur
HTTP
WAF
62
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api/route
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2001
Chemin / cible
/api/route
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 74
Confiance : Confiance 95 % — Motif catalogue confirmé · 10 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api/route HTTP/1.1
User-Agent
Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api/route HTTP/1.1
Host: 62.3.50.33:2001
Content-Length: 512
Connection: close
User-Agent: Mozilla/5.0 (X11; CrOS x86_
Requête brute (extrait)
POST /api/route HTTP/1.1 Host: 62.3.50.33:2001 Content-Length: 512 Connection: close User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Next-Action
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "d336075c3988c6b7205cebd57d13f49ace6a0b3b",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "1a9b2c3dbe8a713bfc0c240bb1a6ea2141b55601",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 935,
"payload_entropy": 5.660478421984566,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 74,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "9fe2bc65e2a7a7137294ad72972f0493210278cb",
"event_fingerprint": "5ae0e42e66d8aa6cb0db279add1c163bf58958c1",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "5ea6889a59d080298a42c0e1b4758211",
"payload_hash": "1d27ae1bce9d8997c828027196e7335d",
"path_pattern_hash": "7c4fe35e07eebe8bea27a36c14378e32"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_",
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_",
"evidence": {
"method": "POST",
"path": "\/api\/route",
"user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api\/route HTTP\/1.1",
"request_sample": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action",
"payload_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4a6d86622ba99d8105fedaffd85530fa439be250",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_",
"attack_vector": "http smuggling probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/route",
"request_line": "POST \/api\/route HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/route",
"evidence_snippet": "POST \/api\/route HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; CrOS x86_",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 10 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:2001"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_api_route_probe",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
18/07/2026 23:22:50 UTC
TCP
2001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:2001 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 74
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) Appl…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2001
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 74
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:2001
Content-Length: 512
Connection: close
User-Agent: Mozilla/5.0 (Linux; Andr
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:2001 Content-Length: 512 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 979,
"payload_entropy": 5.68042700063534,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 74,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "4e85e680299eeaa9184b43450fedadef3e902102",
"event_fingerprint": "5f204686dce0736dfe67e985104dea9cc22e1f6d",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c772734c6eb2978096c283068906aec3",
"payload_hash": "9214a26bd313487cdc15249724236559",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "141d807f3469e44c9631a639a44b0d73e42f19a4",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"attack_vector": "http smuggling probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 512\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Andr",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:2001"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
18/07/2026 23:22:50 UTC
TCP
2001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:2001 · (tentative d'exploit) · → /app
Élevée
Élevé · 74
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2001
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 74
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:2001
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; U; Android 4.
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:2001 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30 Accept-Encoding: gzip, de
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "22d9380abcdf97c82db21728e444020cf16735ea",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 967,
"payload_entropy": 5.6499919151541205,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 74,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "140ffed11c60cdd6a4ab67c1208c8d35c009ae86",
"event_fingerprint": "0caee26dd7952999218f077da2cae1791c4b6b71",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "6c8160595869adea51d6742918f57fdf",
"payload_hash": "5d0e897448b161c857731fabcdf0216e",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, de",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.0 Safari\/534.30\r\nAccept-Encoding: gzip, de",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "da3c2cd95c38de3c06128c65770d2ba2157b39ec",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"attack_vector": "http smuggling probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; U; Android 4.2.2; he-il; NEO-X5-116A Build\/JDQ39) AppleWebKit\/534.30 (KHTML, like Gecko) Version\/4.\u2026",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; U; Android 4.",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:2001"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
18/07/2026 23:22:49 UTC
TCP
2001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:2001 · (tentative d'exploit) · → /api
Élevée
Élevé · 74
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100…
Émulateur
HTTP
WAF
56
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/api
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2001
Chemin / cible
/api
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 74
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /api HTTP/1.1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
k8s-api
Payload (extrait)
POST /api HTTP/1.1
Host: 62.3.50.33:2001
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win
Requête brute (extrait)
POST /api HTTP/1.1 Host: 62.3.50.33:2001 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136. Accept-Encoding: gzip, deflate Next-Action: x X-Nextjs-Request-Id: poop1234 C
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "fac64969f9eca34262c56352be2d62dd2d22b1a0",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "ada91241341ae792ecf0a59cad28616a77bab856",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 906,
"payload_entropy": 5.608621499369061,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 74,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "6d30453c1d7a689bdd29577212c52864be9893d1",
"event_fingerprint": "17c25fe08c0fac69f8e308f6df3b819599f5f5c6",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "9f10b48170735feac18b44fa385fef37",
"payload_hash": "11a1e1e3ff0bf4bea5eac64a293e61e9",
"path_pattern_hash": "702acf7c08d3b03b321d97b4903ad221"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nC",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"evidence": {
"method": "POST",
"path": "\/api",
"user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"k8s-api"
],
"request_line": "POST \/api HTTP\/1.1",
"request_sample": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.\r\nAccept-Encoding: gzip, deflate\r\nNext-Action: x\r\nX-Nextjs-Request-Id: poop1234\r\nC",
"payload_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5356302622abf94834fba80cdfa7c136987f902e",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"attack_vector": "http smuggling probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api",
"request_line": "POST \/api HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko\/20100101 Firefox\/136.",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api",
"evidence_snippet": "POST \/api HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:2001"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950600:k8s-api",
"http_contenttype_attack_surface",
"http_probe_api",
"http_prototype_pollution",
"http_ssti"
]
}
18/07/2026 23:22:47 UTC
TCP
2001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:2001 · (tentative d'exploit) · → /_next
Élevée
Élevé · 74
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2001
Chemin / cible
/_next
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 74
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next HTTP/1.1
Host: 62.3.50.33:2001
Content-Length: 517
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 10;
Requête brute (extrait)
POST /_next HTTP/1.1 Host: 62.3.50.33:2001 Content-Length: 517 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-Acti
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "afd9bdeafd8c657f6b493ada03c51e348516227b",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 944,
"payload_entropy": 5.649178961207327,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 74,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "140ffed11c60cdd6a4ab67c1208c8d35c009ae86",
"event_fingerprint": "6660630047596e7081231760c8a2987fb074e696",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966",
"payload_hash": "0bd3a1fe66d93b51c54e21c27cef5456",
"path_pattern_hash": "bfd33612e3863357684bd23d10455a76"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;",
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Acti",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;",
"evidence": {
"method": "POST",
"path": "\/_next",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next HTTP\/1.1",
"request_sample": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Acti",
"payload_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e9f15aa954b0935b2a0910c0190201a357233371",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;",
"attack_vector": "http smuggling probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next",
"request_line": "POST \/_next HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next",
"evidence_snippet": "POST \/_next HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 517\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10;",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:2001"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
18/07/2026 23:22:45 UTC
TCP
2001
—
Sonde port
Sonde port · port 2001 · (sonde / probe)
Faible
Moyen · 44
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
Méthode
—
Port
2001
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": null,
"app_proto": null,
"asn": 49870,
"country": "SC",
"dst_port": 2001,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.7,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "1e5e319ed345364f04ea073684960b562df31677",
"event_fingerprint": "5ebf9983e0d60a6267bb52fd2c108c8b62d9fe4c",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 2001,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "38dffeee4eccab9b7660f71f1a19974a6778ad40",
"protocol_details": {
"port": 2001
},
"attack_vector": "Sonde port \u00b7 port 2001 \u00b7 (sonde \/ probe)",
"target_port_label": "2001",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 2001
},
"attack_vector": "Sonde port \u00b7 port 2001 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "2001",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
18/07/2026 23:22:45 UTC
TCP
2001 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:2001 · (tentative d'exploit)
Élevée
Élevé · 74
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST / UA Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) Appl…
Émulateur
HTTP
WAF
55
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
2001
Chemin / cible
/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 74
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: 62.3.50.33:2001
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWM
Requête brute (extrait)
POST / HTTP/1.1 Host: 62.3.50.33:2001 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 9; AFTWMST22 Build/PS7233; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.152 Mobile Safari/537.36 Accept-Enco
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "1cafc1ec7983977ff1b9c77c60e09ef5fe869a95",
"http_host_hash": "a6101899207e545cdb10caa8daa2ee36a0d20a47",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 981,
"payload_entropy": 5.662920026354779,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 2001,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 5.7,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 74,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "51d4d2d6260efef6251f031ec446e5a130f60e63",
"event_fingerprint": "aa37c69f678ad82b01f5826cc77c446728bd3a06",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "c772734c6eb2978096c283068906aec3",
"payload_hash": "c6ac31624d3cb7c5d0a02d584d4153b5",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2001,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-Enco",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"evidence": {
"method": "POST",
"path": "\/",
"user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0",
"sap-sapcontrol-path"
],
"request_line": "POST \/ HTTP\/1.1",
"request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88.0.4324.152 Mobile Safari\/537.36\r\nAccept-Enco",
"payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e430ad450e2700a1468d48422a1d633aed329b0d",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"attack_vector": "http smuggling probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit)",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 74,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2001,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/",
"request_line": "POST \/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 9; AFTWMST22 Build\/PS7233; wv) AppleWebKit\/537.36 (KHTML, like Gecko) Version\/4.0 Chrome\/88\u2026",
"port": 2001,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:2001 \u00b7 (tentative d'exploit)",
"evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:2001\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 9; AFTWM",
"target_port_label": "2001 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2001"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:2001"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"950734:sap-sapcontrol-path",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
18/07/2026 22:52:05 UTC
TCP
9527 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:9527 · (tentative d'exploit) · → /_next/server
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /_next/server UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537…
Émulateur
HTTP
WAF
58
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/_next/server
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9527
Chemin / cible
/_next/server
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 9 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /_next/server HTTP/1.1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /_next/server HTTP/1.1
Host: 62.3.50.33:9527
Content-Length: 518
Connection: close
User-Agent: Mozilla/5.0 (Macintosh;
Requête brute (extrait)
POST /_next/server HTTP/1.1 Host: 62.3.50.33:9527 Content-Length: 518 Connection: close User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate N
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "8447a2dfcfbbdcc75d5b5272da958411ec73dd1a",
"http_host_hash": "59aa5fe35caa9c4916e7c98513cff342cf1470be",
"http_target_hash": "bef481449499f499a0b29ed75c9630076205b04f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 953,
"payload_entropy": 5.650104576836165,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 9527,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "1929d3e39183afa124ca234556c66d7b0f1f6c59",
"event_fingerprint": "f1fdb000ddf22043573025ed6a998fc6b0c52e0d",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "93af66442f9c9958e5fcc0142d9e74de",
"payload_hash": "b6922c21f183e855d3b4ca15b35499a9",
"path_pattern_hash": "4d9c4ca8a8065d3ce7073b6b23f61056"
},
"target_context": {
"dst_port": 9527,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9527\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; ",
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9527\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9527\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"evidence": {
"method": "POST",
"path": "\/_next\/server",
"user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/_next\/server HTTP\/1.1",
"request_sample": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9527\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nN",
"payload_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9527\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5729371bdd36e5749b79953b6a6ffb3d729ce3cd",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 9527,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9527\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"attack_vector": "http smuggling probe \u00b7 via HTTP:9527 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"target_port_label": "9527 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9527,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/_next\/server",
"request_line": "POST \/_next\/server HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.0.0 Safari\/537.36",
"port": 9527,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:9527 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_next\/server",
"evidence_snippet": "POST \/_next\/server HTTP\/1.1\r\nHost: 62.3.50.33:9527\r\nContent-Length: 518\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Macintosh;",
"target_port_label": "9527 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 9 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 9 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9527"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:9527"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950468:nosqli-3",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}
18/07/2026 22:52:05 UTC
TCP
9527 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:9527 · (tentative d'exploit) · → /app
Élevée
Élevé · 72
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /app UA Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, l…
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950019:sqli-4
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/app
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
9527
Chemin / cible
/app
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 72
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /app HTTP/1.1
User-Agent
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36
Règles WAF
sqli-4
rce-0
rce-2
rce-14
nosqli-3
proto-0
upload-0
Payload (extrait)
POST /app HTTP/1.1
Host: 62.3.50.33:9527
Content-Length: 522
Connection: close
User-Agent: Mozilla/5.0 (Linux; Android 10; K
Requête brute (extrait)
POST /app HTTP/1.1 Host: 62.3.50.33:9527 Content-Length: 522 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.135 Mobile Safari/537.36 Accept-Encoding: gzip, deflate Next-Action
Meta JSON brut
{
"http_header_count": 9,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "8563f2ed0fd1b3832e8c528ca96b1f98a5b0004e",
"http_host_hash": "59aa5fe35caa9c4916e7c98513cff342cf1470be",
"http_target_hash": "0c35eebf403cf91fe77a64921d76aa1ca6411d20",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 949,
"payload_entropy": 5.66557184328053,
"port_category": "registered",
"org": "Alsycon B.V.",
"service": "http",
"app_proto": "http",
"asn": 49870,
"country": "SC",
"dst_port": 9527,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 10,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 72,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "e2f81100df7a1ccbaa46905df1a109c9796ee171",
"event_fingerprint": "37662a32620810142b6d80836d8e9323ef0f9a3d",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "SC",
"asn": 49870,
"org": "Alsycon B.V.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "fcf5bfa409c42db4e4a5f32bcc91f966",
"payload_hash": "36acf5943e77dda2d4c8cf55cc2e5aa2",
"path_pattern_hash": "f53b52ad6d21cceb72dfa78fb67614fe"
},
"target_context": {
"dst_port": 9527,
"service": "http",
"service_name": "http",
"risk_score": 72
},
"payload_preview": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9527\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9527\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9527\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"evidence": {
"method": "POST",
"path": "\/app",
"user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"waf_tags": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0"
],
"waf_rule_names": [
"sqli-4",
"rce-0",
"rce-2",
"rce-14",
"nosqli-3",
"proto-0",
"upload-0"
],
"request_line": "POST \/app HTTP\/1.1",
"request_sample": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9527\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36\r\nAccept-Encoding: gzip, deflate\r\nNext-Action",
"payload_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9527\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b17fb128456619449714eee00dace014c54ac074",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 9527,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9527\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"attack_vector": "http smuggling probe \u00b7 via HTTP:9527 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"target_port_label": "9527 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 72\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 72,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 72,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 9527,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/app",
"request_line": "POST \/app HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0 (Linux; Android 10; K) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/134.0.6998.135 Mobile Safari\/537.36",
"port": 9527,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:9527 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app",
"evidence_snippet": "POST \/app HTTP\/1.1\r\nHost: 62.3.50.33:9527\r\nContent-Length: 522\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (Linux; Android 10; K",
"target_port_label": "9527 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "9527"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:9527"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950019:sqli-4",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950382:rce-14",
"950470:nosqli-3",
"950493:proto-0",
"950549:upload-0",
"http_contenttype_attack_surface",
"http_prototype_pollution",
"http_ssti"
]
}